BANK OF BARODA INVESTIGATES CYBER INCIDENT AFTER EMPLOYEE EMAIL ACCOUNT WAS COMPROMISED

INDIA — Bank of Baroda has confirmed a cybersecurity incident involving a compromised employee email account after an unidentified threat actor claimed to have stolen and published sensitive banking information.

The state-owned financial institution said unauthorized access through the employee’s account exposed “certain data.” The bank reported that it detected and contained the incident immediately and has launched an investigation to determine its full scope.

Bank of Baroda said its core banking systems were not accessed or affected.

That distinction is significant because core banking infrastructure manages essential operations involving customer accounts, deposits, balances, payments, loans, and transactions. The bank’s statement indicates that the unauthorized access originated through an employee email account and did not reach the core banking systems responsible for processing its primary financial services.

A compromised employee mailbox can still contain business communications, documents, contact information, internal records, and attachments. The sensitivity of any exposed material depends on the employee’s position, account permissions, correspondence, and access to organizational information.

The bank has not identified the employee involved, explained how the account was compromised, or disclosed how long unauthorized access may have continued before detection. It has also not stated whether the incident involved phishing, stolen credentials, malware, session-token theft, or another intrusion method.

Public attention surrounding the incident began after a threat actor using the name “leak-king-F” claimed to have breached Bank of Baroda and obtained customer information, corporate-banking records, internal emails, loan documents, and audit files.

The threat actor allegedly advertised the material for sale through a darknet marketplace and directed prospective buyers to a Telegram channel.

The authenticity and origin of the advertised files have not been independently established. Bank of Baroda has not confirmed that the material came from its systems or that customer information was removed during the email compromise.

The bank also has not attributed the incident to the individual operating under the “leak-king-F” identity or to any established cybercriminal organization.

Claims posted on underground marketplaces require careful scrutiny because threat actors can exaggerate the scope of an intrusion, combine recently stolen information with older records, misrepresent third-party data, or falsely attach a recognized company’s name to material offered for sale.

The existence of a confirmed email compromise does not by itself verify every claim made by the person advertising the alleged files. The bank’s continuing investigation will need to determine what information was accessible through the affected account, whether data was copied or transmitted, and whether any customers or business partners were exposed.

Bank of Baroda has not announced any disruption to customer services, payment processing, account access, or other banking operations. It has also not identified evidence that attackers altered account balances or conducted unauthorized transactions through its core banking platform.

The incident demonstrates how a single employee account can create an entry point into sensitive organizational communications without requiring an attacker to compromise an institution’s central banking network.

Email accounts remain valuable targets because they can provide information about internal operations, employees, customers, vendors, financial arrangements, and security procedures. A compromised mailbox can also be used to impersonate an employee, redirect payments, distribute malicious files, or target other personnel through convincing internal messages.

The Bank of Baroda incident follows other recent cyber events affecting major organizations across Asia.

Thailand’s Securities and Exchange Commission opened an investigation into a breach involving the Thailand Securities Depository after attackers gained unauthorized access to an investor portal. The depository reported that its trading, settlement, and central depository systems were not affected.

The ransomware and extortion operation World Leaks also published files it claimed were taken from contractors associated with India’s largest nuclear-power project. India’s state-owned nuclear operator said the documents did not contain information affecting the plant’s safety or security and appeared to have originated from a third-party company working on conventional, non-nuclear infrastructure.

World Leaks separately claimed responsibility for an attack involving Tata Electronics, a supplier serving major international technology and automotive companies. The group demanded a $1.5 million ransom before publishing material it described as confidential engineering documentation.

No connection has been established between those incidents and the compromise at Bank of Baroda.

Bank of Baroda’s investigation remains active. Until the review is completed, the amount and sensitivity of any information exposed through the employee email account remain undetermined, and the broader data-theft claims remain unverified.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE