A threat actor claims to have breached Bank of Baroda and leaked ~1TB of data, including KYC forms, loan records, audit reports, and account statements, on the dark web
The incident has been linked to an emergent ransomware group called Triple X
Threat-intel trackers note the 1TB figure and scope remain unverified, and sample data alone doesn't prove core systems were compromised
Bank of Baroda Hit by 1TB Data Leak: What's Been Exposed
In the post, the sample screenshots shared show account opening forms, KYC documents, loan appraisal notes, internal audit reports, vigilance handbooks, and customer statements, some bearing names, photographs, and account numbers
Bank of Baroda Hit by 1TB Data Leak: What's Been Exposed
Summary
Advertisement
A threat actor claims to have breached Bank of Baroda's systems and put roughly 1TB of sensitive customer and internal data up for free download on the dark web, according to posts from Srikanth Lakshmanan, founder of CashlessConsumer, who first flagged the leak on X (formerly Twitter).
The bank has not issued a public statement on the allegations. There has been no confirmation from CERT-In or the Reserve Bank of India either.
Lakshmanan's posts describe an open, unauthenticated directory listing tied to Bank of Baroda, spanning 95 top-level branch folders and thousands of subdirectories.
What the leaked data contains
In the post, the sample screenshots Lakshmanan shared show account opening forms, KYC documents, loan appraisal notes, internal audit reports, vigilance handbooks, and customer statements, some bearing names, photographs, and account numbers.
A subsequent "intelligence report" he posted put the scale at roughly 15,774 files across 2,671 subdirectories, with PDFs (branch audits, KYC records) making up the bulk, alongside hundreds of spreadsheets and archive files he flagged as carrying structured financial data.
Advertisement
Lakshmanan told India Today that he was able to partially verify the documents, saying they included branch audits, loan appraisal documents, internal communications, vigilance investigations, BoBWorld audit reports, and customer application forms across multiple BoB branches.
He separately estimated, without confirmation, that the underlying intrusion may have occurred around June 24, 2026. Asked about the incident, Lakshmanan said that "It's a cyber disaster," as per the report.
Threat-intel account Dark Web Intelligence separately reported that the actor is claiming approximately 1 TB of data covering savings and current accounts, loan records, Net-Banking users, NRI and corporate banking services, customer support material, and branch or ATM-related records.
However, the post also cautioned that the volume and scope remain unverified and that sample data alone doesn't confirm the bank's core systems were compromised.
Triple X Ransomware Group
Lakshmanan's posts attribute the leak to a group he calls "Triple X," describing it as a relatively new ransomware-as-a-service and data-extortion outfit first observed around May 2026, whose only prior confirmed victim was Indonesia's Bank Negara Indonesia (BNI).
Advertisement
He noted the group's approach involves publishing complete recursive directory listings rather than limited samples, and suggested, with what he called low-to-moderate confidence, that initial access may have stemmed from a weak password at a regional branch, given a concentration of exposed files tied to Shivamogga (Karnataka) and Bhilwara (Rajasthan) offices.
What Should Customers Do?
In one of the posts, Lakshmanan urged Bank of Baroda's roughly 15 crore customers to change digital banking passwords across BoB World, internet banking and mConnect Plus; block and reissue cards; enable transaction alerts; lock Aadhaar biometrics via the UIDAI portal; and watch for targeted phishing attempts, given the exposure of contact and account details.