Customer data from India's Bank of Baroda leaked online, source and researcher say

The leaked data includes customer details, identification documents, loan papers and internal audit records.

MUMBAI – Customer data from India’s state-run Bank of Baroda, along with internal documents, has been leaked on the dark web, according to a source familiar with the matter and a cybersecurity researcher.

The lender said in a statement on July 27 that it had started a forensic investigation and was working with the relevant authorities after initial containment measures were implemented.

The breach involved a compromised employee e-mail account, which resulted in “unauthorised access to certain data”, the Mumbai-based bank said.

“The bank’s core banking systems were not accessed and continue to remain secure,” it added.

The leaked data includes customer details, identification documents, loan papers and internal audit records, said cybersecurity researcher Srikanth L, founder of Cashless Consumer.

It was not immediately clear how many customers were affected.

The Reserve Bank of India and India’s cybersecurity regulator CERT-In did not immediately respond to requests for .

The leak comes amid growing concerns over cybersecurity risks facing large companies and financial institutions that store vast amounts of customer and business data.

Preliminary indications suggest the incident stemmed from a compromised e-mail system, the source said.

The data appeared on a dark website on the night of July 25 and was advertised as a cache containing more than 700 gigabytes of information, based on metadata analysis of the site, Srikanth said.

In June, a cyberattack on Apple supplier Tata Electronics led to component design and specification documents linked to Apple and Tesla being leaked on the dark web.

Earlier in July, ransomware group World Leaks posted files on the dark web related to India’s largest nuclear plant. REUTERS