One of India’s largest financial institutions, Bank of Baroda, has disclosed a significant data security incident after threat actors claimed to have breached its internal network and exfiltrated confidential data.
Headquartered in Vadodara, Gujarat, Bank of Baroda is one of India’s largest public sector banks. Founded in 1908, the bank offers a wide range of retail, corporate, and international banking services and has a strong presence in India and overseas.
In a data security incident disclosure filed with the Bombay Stock Exchange (BSE) on July 27, Bank of Baroda said it had recently received a communication from an anonymous source claiming to have gained access to certain data.
The bank immediately launched an investigation with the support of external cybersecurity experts to assess the nature and scope of the incident. It also activated its cyber incident response and containment protocols, while engaging a CERT-In empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the extent of the alleged compromise.
“Based on the preliminary findings available at this stage, the incident has been identified as potential business email compromise and not expected to have any material impact on the Bank’s operations, financial performance or business continuity.
“The Bank’s core business functions continued to operate normally without disruption. A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required,” BOB said.
x.com/DailyDarkWeb/status/2080939146734874885
Bank of Baroda disclosed the data security incident after a threat actor claimed to have compromised the bank’s internal network and exfiltrated nearly 1 TB of confidential data. As proof of the breach, the threat actor released sample datasets purportedly containing personal and corporate banking records, savings and current account information, loan details, NetBanking user data, NRI and corporate banking service records, customer support information, and branch and ATM-related records.
The leaked samples also included customer forms containing personally identifiable information (PII), such as identity documents, contact details, and account-related information.
