Sensitive information from the Bank of Baroda, including customer data and internal documents, has been leaked on the dark web following a cyber attack, according to Reuters.

Citing a person close to the matter and a cybersecurity researcher, the news agency said the leaked cache includes customer information, loan papers, identification documents, and internal audit records.

Srikanth L, founder of Cashless Consumer, told Reuters that 700 GB of data from the Bank of Baroda was posted on the dark web on 25 July.

In a statement, the bank said an employee’s email account was compromised, leading to the exposure of “certain data,” but that the incident had been contained.

“The bank’s core banking systems were not accessed and continue to remain secure,” it said. “A comprehensive forensic investigation has been initiated, and the bank is working closely with the relevant authorities in accordance with applicable regulatory requirements.”

India’s second largest public sector bank, the Bank of Baroda has over 183 million customers worldwide and over 8,400 branches in India alone. The scale of customers affected by the reported breach is currently unclear.

Email compromise is an extremely common vector for cyber attacks. As many as 91 per cent of cyber attacks start with phishing emails, according to the cybersecurity company Fortra, while the Department for Science, Innovation, and Technology’s cyber security breaches survey 2025/2026 found that 38 per cent of businesses have experienced phishing in the past 12 months.

---