On July 25, a dark web monitoring page called ransomware.live quietly flagged something unusual: a folder claiming to hold roughly 1TB of Bank of Baroda data, sitting on a Tor site, free to download. No paywall, no auction, just open access. That detail alone should worry you more than the headlines do. Ransomware crews usually sell data to the highest bidder. Giving it away for free is either a marketing stunt to build a hacker’s reputation, or a sign the data has already been sold privately and this is just the leftover, being dumped for publicity.
Cybersecurity researcher Srikanth Lakshmanan, who first examined the sample files, called it a “cyber disaster” after finding what looked like real Bank of Baroda material with branch audit reports, loan appraisal documents, vigilance investigation files, internal communications, and account-opening forms carrying names, photographs, and identity documents including Aadhaar numbers. He flagged it directly to the RBI, the bank, and the IT ministry.
Two days later, on July 27, the bank broke its silence. In an official statement, Bank of Baroda said the incident traced back to one compromised employee email account, which led to unauthorised access to certain data. It said the matter was identified quickly and containment measures were put in place immediately, and crucially that its core banking systems were never accessed and remain secure. “A comprehensive forensic investigation has been initiated, and the Bank is working closely with the relevant authorities in accordance with applicable regulatory requirements,” the bank said.
Read that statement carefully, because what it says is almost as telling as what it doesn’t. It confirms an incident happened. It does not confirm that 1TB of data is genuine, does not confirm Aadhaar numbers were part of what was taken, and does not say how many customers are affected. A single hacked inbox explains how an attacker got a foothold it does not, by itself, explain how that foothold turned into a terabyte of files spanning multiple branches, loan files, and audit records, if that scale of leak is accurate. That gap between “we found the entry point” and “here’s the actual scope” is exactly where most corporate breach statements quietly stop talking.
Insider job, hack, or something duller? The bank’s own account points to the least dramatic explanation, and also the most common one worldwide: a phished or stolen employee credential, not a sophisticated break-in of the core system, and not necessarily a malicious insider either. Most “mega leaks” don’t start with someone storming a firewall. They start with a single email account that had access to more than it should have. The researcher tracking this incident points to a relatively new extortion group called TripleX, first seen around May 2026, which allegedly hit Indonesia’s Bank Negara Indonesia the same way walking off with roughly 2TB of data. If the same group compromised a BoB employee’s inbox using a similar method, it suggests a repeatable playbook targeting bank staff credentials across South and Southeast Asia, not a one-off grudge or tip-off.
There’s also a quieter irony here. Bank of Baroda has been down this road before. In 2023, the RBI invoked Section 35A of the Banking Regulation Act to stop the bank from onboarding new customers on its bobWorld app, after irregularities were found in how accounts were being linked and activated. It wasn’t a hack, it was sloppy internal process. That history matters, because data exposure risk isn’t only about hackers outsmarting firewalls; it’s about how carefully an institution handles millions of records day to day.
What’s actually at stake for customers. If genuine, Aadhaar-linked leaks don’t just enable simple phishing calls they feed “identity stitching,” where fraudsters combine your Aadhaar, phone number, and loan history from different leaks over the years to impersonate you convincingly enough to pass KYC checks at other institutions. That’s the quiet long-game risk: not tomorrow’s OTP scam, but a fraudulent loan taken in your name eighteen months from now.
What to actually do, whatever the final scale turns out to be: freeze or monitor your CIBIL report, never share OTPs even to “verify” the leak, treat any bank call referencing “your leaked data” as a scam attempt itself, and use net banking transaction limits as a safety valve. Bank of Baroda has confirmed the incident and launched a forensic audit, but has stopped short of confirming the leaked dataset’s full contents or size. Until that audit closes, treat this as a confirmed breach of unconfirmed scale. Not panic. Vigilance.