700 GB Bank of Baroda data leaked via compromised email on dark web

The Bank of Baroda breach is a textbook case of how a single email account, likely hijacked through phishing or credential stuffing, can trigger a massive data exfiltration. For cybersecurity professionals, the 700 GB cache — containing ID documents, loan papers, and audit records — signals that attackers had prolonged, undetected access to sensitive file repositories, underscoring the inadequacy of conventional email security and lateral movement detection in large financial institutions.

A significant data breach at India's state-owned Bank of Baroda has exposed customer data and internal documents on the dark web, highlighting persistent cybersecurity vulnerabilities in the financial sector. According to a source familiar with the matter and cybersecurity researcher Srikanth L, founder of Cashless Consumer, the leaked cache surfaced on a dark web forum on the night of Saturday, July 25, 2026, advertised as containing more than 700 gigabytes of data. The breach was traced to a compromised employee email account, which Bank of Baroda confirmed in a statement on Monday, July 27. The bank said it had initiated a forensic investigation, implemented initial containment measures, and was coordinating with relevant authorities. It emphasized that core banking systems were not accessed and remain secure. The exposed data reportedly includes customer details, identification documents, loan papers, and internal audit records, though the total number of affected customers remains unclear.

“

The Bank of Baroda breach is a textbook case of how a single email account, likely hijacked through phishing or credential stuffing, can trigger a massive data exfiltration.

This incident is not isolated. It follows a June 2026 cyberattack on Apple supplier Tata Electronics, where design and specification documents linked to Apple and Tesla were leaked on the dark web, and an earlier July 2026 ransomware posting by group World Leaks of files related to India's largest nuclear plant. The Bank of Baroda breach thus fits a pattern of escalating cyber threats against major Indian institutions, from manufacturing to critical infrastructure to finance. The compromised email account vector is a common and often underestimated entry point; attackers frequently exploit weak credentials or phishing to gain initial access, then move laterally to harvest sensitive data. The fact that the bank's core systems were reportedly untouched suggests the attackers may have targeted specific mailboxes or file shares rather than the transaction processing backbone, but the leak of audit records and loan documentation could still pose serious risks, including fraud and identity theft.

The scale of the data — 700 GB — is substantial for a targeted email compromise, indicating either a massive data dump from a single account with extensive access or lateral movement to aggregate files. The advertisement on the dark web suggests the data is being sold or circulated, raising the possibility of secondary exploitation. For a public sector bank with a vast customer base across India, the operational and reputational impact could be severe, especially as digital banking adoption accelerates. The Reserve Bank of India (RBI) and CERT-In, the country's cybersecurity regulator, have not yet commented, but regulatory scrutiny is likely to intensify, possibly leading to mandates for multi-factor authentication, stricter data access controls, and more rigorous breach notification requirements.