A cyber case related to the public sector Bank of Baroda has come to light. It is alleged that customer data and some internal documents were leaked on the dark web. Confirming the incident, the bank has started forensic investigation.
**What did the bank say?**
According to the bank, an employee’s email account was hacked, leading to unauthorized access to some data. The bank said that the incident was detected in time and necessary steps were taken immediately. The bank clarified that its core banking system is completely secure and there has been no breach in it. The bank further said that a detailed forensic investigation is underway and it is cooperating with relevant agencies as per rules. The bank also reiterated its commitment towards keeping the information of its customers and partners secure.
**What is the claim of the researcher?**
Cyber researcher Srikant L claims that the leaked data includes customer information, identity documents, loan related documents and internal audit records of the bank. According to him, this data was first seen on dark web monitoring website ‘ransomware.live’ on July 25.
**Which documents are alleged to have been leaked?**
According to the researcher, the sample documents that have come to light include account opening forms, customer names, photos, Aadhaar numbers, branch audit reports, loan appraisal documents, internal conversations and records related to vigilance investigation. However, these claims have not been independently confirmed.
**How big is the data leak?**
Different claims are being made regarding the size of the data leak. The website where the data appeared put its size at more than 700 GB, while some Indian media reports put the size at around 1 TB. It is not yet clear how many customers have been affected by this incident.
**Who did the cyber attack?**
Till now no cyber criminal group has taken responsibility for this incident. However, cyber researchers speculate that a new hacking group named ‘TripleX’ may be behind this.
Response of RBI and CERT-In
There has been no official response yet from the Reserve Bank of India (RBI) or CERT-In on this matter. According to reports, the bank is conducting a forensic audit. Meanwhile, Bank of Baroda has not yet separately informed the stock exchange about any data breach. There is a difference between the claims of the bank and the cyber researcher. The bank claims that the incident is limited to only one employee’s email account and the core banking system is completely secure. On the contrary, experts say that a lot of customer data and internal documents of the bank have been leaked. Therefore, the real scope and impact of this data leak will be known only after the forensic investigation is completed and confirmed by the concerned agencies.
