State-owned Bank of Baroda is investigating claims of a major cybersecurity breach after reports claimed that around 1TB of sensitive customer and internal banking data had allegedly been leaked on the dark web.
Event Context
The alleged leaked archive is said to contain personal and corporate banking records, including Aadhaar numbers, customer names, savings and current account details, loan documents, NetBanking user information, NRI and corporate banking records, customer support files, and branch- and ATM-related data. Sample files purportedly linked to the breach have also surfaced online.
Cybersecurity researcher and CashlessConsumer founder Srikanth Lakshmanan said the alleged breach first came to light on Saturday after it was flagged by dark web monitoring platform ransomware.live. He said his preliminary verification suggested the files contained both internal bank records and customer information.
The group came into focus after claiming responsibility for the alleged breach of Indonesia’s state-owned PT Bank Negara Indonesia (BNI), where it claimed to have exfiltrated around 2TB of customer and internal data, including contracts and identification records.
source
According to the threat actor, the leaked archive contains around 1TB of banking data. Lakshmanan also said a relatively new cybercrime group known as TripleX may be behind the attack. “Triple X – expands to triple extortion – but motivations remain unclear,” he wrote on X.
“This is the quality of bank branch audit ‘Delete which is not applicable’. No one ever reads these. Is this even a bank? How long you can continue your incompetent willfull ignorance of regulatory omissions in AI-Cyber era?” he wrote on X.
Responding to the reports on Monday, Bank of Baroda said the incident involved the compromise of an employee’s email account and not its core banking infrastructure.
“The incident involved compromise of an employee’s e-mail account, resulting in unauthorised access to certain data,” the bank said in a post on X.
The lender said its core banking systems remain secure and were not accessed by the perpetrators. It added that the issue was detected promptly and containment measures were immediately implemented.
“The matter was identified promptly, and containment measures were implemented,” the bank said.
Lakshmanan reacted, saying, “Email access compromise cannot lead to exfiltration of multi hundred gigabytes of data. We urge @bankofbaroda to share detailed report and also alert impacted customers.”
It is an emerging cybercrime/data extortion group first observed in May 2026. TripleX is known for allegedly stealing large volumes of data from organizations and publishing or threatening to publish the information on dark web leak sites rather than deploying traditional ransomware, as per the website SOCRadar.
