Bank of Baroda Confirms Data Breach via Compromised Employee Email

India's state-run Bank of Baroda confirmed on July 27, 2026, that customer information and internal documents were leaked online after unauthorized access to a compromised employee email account.

The bank stated its core banking systems were not accessed and "continue to remain secure." The breached data includes customer details, identification documents, loan papers, and internal audit records.

Cybersecurity researcher Srikanth L analyzed metadata from the leaked cache and estimated the volume at over 700 gigabytes. Other reports cite hacker claims of approximately 1 terabyte, though the exact volume remains unconfirmed. Some researchers suspect the cybercriminal group 'TripleX,' but no group has officially claimed responsibility.

Bank of Baroda said it has launched a forensic investigation and implemented immediate containment measures. The breach did not compromise the bank's core transaction systems, which handle customer accounts and transfers.

The incident shows how credential compromise at the employee level can expose sensitive financial data even when core infrastructure remains intact. Internal audit records and loan documentation in the leaked cache could pose significant privacy and operational risks to affected customers.

The breach arrives amid a surge of cybersecurity incidents targeting major Indian corporations. In June, Apple supplier Tata Electronics suffered a data attack. Separately, the 'World Leaks' group claimed access to servers belonging to Reliance Infrastructure, a contractor involved in India's largest nuclear power facility, though the plant's own systems were not directly breached.

Financial institutions remain prime targets for credential-based attacks, which often bypass technical defenses by exploiting human factors. Security experts have long warned that employee email accounts can serve as entry points to broader corporate networks, even when critical systems are segmented.

Bank of Baroda, one of India's largest public sector lenders with over 9,000 branches domestically and international presence across 20 countries, serves millions of retail and corporate customers. The bank has not disclosed how many customers may be affected.

Customers are advised to monitor their accounts for suspicious activity and report any unauthorized transactions immediately. The forensic investigation is ongoing.