Bank of Baroda has officially confirmed unauthorised data access following an employee email compromise, marking a significant development in the ongoing cybersecurity investigation. In an official statement, the state-owned lender acknowledged that an employee's email account had been compromised, resulting in unauthorised access to certain data. The bank emphasized that "the breach was limited to the email account and did not extend to its core banking infrastructure." The matter was identified promptly, and containment measures were implemented immediately without providing specific details about the compromised employee's position or the exact timeline of the incident. Bank of Baroda stated it has "robust information security protocols and a comprehensive forensic investigation has been initiated in the matter, and it is working closely with relevant authorities." The issue came to light after cybersecurity observers flagged what appeared to be Bank of Baroda-related files circulating on online monitoring platforms, with sample documents linked to the bank reportedly visible online and a link to the alleged leaked dataset reportedly active.
Bank of Baroda has filed a preliminary claim under its cyber insurance policy after a suspected data breach exposed nearly 1TB of customer data on the darknet. The claim, lodged with lead insurer National Insurance Company, is currently an intimation of loss while forensic investigations continue. As per The Economic Times, the bank has informed lead insurer National Insurance under a cyber insurance programme with a total cover of about ₹750 crore. The claim has been submitted as a notice of loss, allowing insurers to begin assessing the incident while forensic investigations are underway. The loss limit is about ₹300 crore, with the cyber insurance programme carrying an annual premium of around ₹6 crore and backed by multiple domestic insurers and reinsurers. Any eventual payout will depend on the scale of financial losses, regulatory action, business disruption and third-party liabilities arising from the data breach.
According to Reuters, the alleged leaked data includes customer details, identification documents, loan papers and internal audit records, with the leaked cache advertised as containing more than 700 GB of data. The compromised information may also include Aadhaar numbers, account records, internet banking user information and corporate banking records. Bank of Baroda has not confirmed the full contents of the alleged leak, and the forensic investigation is continuing. As per Business Standard, the leaked database allegedly contains a wide range of customer and banking information, including Aadhaar numbers, customer names, savings and current account details, loan-related information, NetBanking user data, NRI and corporate banking records, branch audits, internal communications, vigilance investigation files, bobWorld audit reports, customer application forms, and branch and ATM-related documents from multiple locations across the country. The hacking group TripleX has claimed responsibility for leaking the sensitive data to the dark web, with reports alleging the dataset includes 100,000 to 300,000 customer application forms of BoB customers containing photographs and identify documents submitted during account opening. A listing on dark web monitoring platform Ransomware.live claimed the dataset may contain between 100,000 and 300,000 customer application forms, including photographs and identity documents submitted during account opening.
Despite the bank's assurance that core banking systems remain secure, cybersecurity experts recommend proactive protection measures for customers. CERT-In has specifically warned users to exercise heightened vigilance against phishing, impersonation and social engineering attempts, and to avoid sharing sensitive financial information through unverified channels. Experts recommend changing internet and mobile banking passwords, particularly if the same password is used across multiple websites, enabling multi-factor authentication wherever available, and reviewing recent account activity. Customers should never share their OTP, debit card PIN, UPI PIN, CVV or internet banking password with anyone claiming to be from the bank, and avoid clicking links sent via SMS, WhatsApp or email claiming to "verify your account" or "update KYC" following the reported breach. According to Business Standard, lawyers and cybersecurity guidance broadly agree that customers should act immediately rather than wait for the investigation to conclude. Raheel Patel advised customers to change internet and mobile banking passwords, enable transaction alerts, monitor account activity closely, and immediately report suspicious transactions to the bank. Rohit Jain similarly recommends activating SMS and email transaction alerts, reviewing account statements regularly, changing reused passwords, and never sharing OTPs, PINs or passwords with anyone. The more practical approach is to strengthen account security, remain alert to phishing attempts and monitor transactions while the investigation continues, rather than panicking or closing accounts solely due to breach reports.
The incident could face significant regulatory scrutiny with potential penalties under multiple frameworks. The Reserve Bank of India (RBI) could examine whether Bank of Baroda complied with its cybersecurity and risk management requirements, with the central bank able to direct the lender to strengthen cybersecurity controls and impose penalties for regulatory violations. Separately, the Indian Computer Emergency Response Team (CERT-In) may review whether the bank complied with India's cyber incident reporting rules, including reporting the breach within the prescribed timeline. The incident could also come under the ambit of the Digital Personal Data Protection (DPDP) Act, which provides for penalties of up to ₹250 crore for failing to implement reasonable security safeguards and up to ₹200 crore for failing to report a personal data breach. However, Rohit Jain cautioned that while the Digital Personal Data Protection (DPDP) Act provides for substantial penalties, its principal security, breach-notification and penalty provisions are scheduled to become enforceable only in May 2027, meaning they should not currently be viewed as the primary route for penalties in this incident. The RBI has powers to impose monetary penalties under the Banking Regulation Act where regulatory lapses are established, and CERT-In's binding directions require specified cyber incidents to be reported within six hours.
Bank of Baroda has issued an official statement clarifying its position on the alleged data breach, emphasizing that its core banking systems remain fully secure despite media reports. According to Zee News, the bank stated that "the matter was promptly identified, and immediate containment measures were implemented. The Bank's core banking systems were not accessed and continue to remain secure." The lender confirmed that "a comprehensive forensic investigation has been initiated, and the Bank is working closely with the relevant authorities in accordance with applicable regulatory requirements." Bank of Baroda added that "the Bank remains committed to maintaining the highest standards of information security and to safeguarding the trust of its customers and stakeholders." The statement came after media reports claimed that nearly 1 terabyte of sensitive Bank of Baroda data had surfaced on the dark web, with the compromised data allegedly including information related to personal and corporate banking customers, savings and current accounts, loan-related information, internet banking user details, NRI and corporate banking records, customer support data, and information linked to bank branches and ATMs. As of now, neither the Reserve Bank of India (RBI) nor the Indian Computer Emergency Response Team (CERT-In) has issued any public statement regarding the incident.
Despite the sharp fall in reported earnings, the bank's underlying business performance remained relatively stable. Excluding the exceptional item, the lender's net profit would have increased by around 22% year-on-year, translating to an estimated Return on Assets (RoA) of about 1.1%. Bank of Baroda continued to record growth in its lending business during the quarter. Net Interest Income (NII) rose 9.5% year-on-year to ₹12,524 crore from ₹11,435 crore. However, Net Interest Margin (NIM) narrowed by 12 basis points sequentially due to lower asset yields. Core fee income also declined 22% compared with the previous year, affecting overall operating performance. The bank has a customer base of 183 million with global advances of ₹14.17 trillion, global deposits of ₹16.34 trillion, and global business of ₹30.51 trillion as of 30 June.
The lender also reported improvements in asset quality. Gross Non-Performing Assets (GNPA) declined to 1.99% from 2.24% a year earlier, while Net Non-Performing Assets (NNPA) improved to 0.50% from 0.60%. The Capital Adequacy Ratio (CAR) stood at 16.31%, compared with 17.61% in the corresponding quarter last year. Lower provisioning, supported by the release of standard asset provisions, helped cushion profitability during the quarter.
