Bank of Baroda has reportedly suffered a data breach, with a hacking group claiming that it has leaked nearly 1 TB (1,000 GB) of banking data and sensitive customer information on the dark web for free.
Neither the bank nor any government agencies have officially confirmed the alleged data breach. An India Today report quoting bank sources, however, said that the public sector lender has launched an internal probe to investigate the authenticity of the cyber breach claims.
Personal, bank data on dark web
Dark web monitoring platform Ransomware.live, which spotted the breach on July 25, claims that the dataset uploaded by the hacking group named TripleX includes between 1-3 lakh customer application forms containing photographs and identity documents submitted by customers during opening of accounts.
Also read: Data breach at Kudankulam plant rings alarm bells on cybersecurity of critical infra
The leaked data, consisting of customer names, Aadhaar numbers, loan details, net banking user details, NRI and corporate banking details, customer support material, and branch- or ATM-related records across Bank of Baroda branches, is reportedly available for free download.
Hacker uploads sample documents
To confirm the authenticity of the claim, the hacker has reportedly published sample documents on the internet.
A copy of the sample documents was shared by software engineer and founder of CashlessConsumer Srikanth Lakshmanan on X, stating that the link was live.
“I was able to initially verify the documents and have found a range of internal documents off the bank,” India Today quoted the techie as saying.
Also read: CBSE re-evaluation portal faces cyberattack, records 1.5 million hits in two minutes
He said these documents include branch audits, loan appraisal documents, internal communications, vigilance investigations, bobWorld audit reports, and customer data across multiple Bank of Baroda branches across the country.
Previous data thefts
Srikanth claims that TripleX previously hacked into an Indonesian bank’s system and made the entire dataset publicly available on a Tor site.
Also read: 149 million passwords for Gmail, Facebook, Instagram, others leaked online
In May this year, the group breached the system of PT Bank Negara Indonesia and stole around 2TB of data containing contracts, personal identification details, financial transaction histories and internal banking documents.