Is your Bank of Baroda account at risk? Here’s what the data breach means | Personal Finance

The alleged cyberattack on state-owned Bank of Baroda (BoB) has once again put the spotlight on cybersecurity in India’s banking sector. Nearly 1 terabyte (TB) of customer and corporate banking data has reportedly surfaced on the dark web, making it one of the largest alleged banking data exposures in recent years.

While the bank has maintained that its core banking systems remain secure and that the breach was limited to the compromise of an employee’s email account, the incident joins a growing list of cyber incidents and data breaches that have affected Indian banks over the past decade.

What exactly happened?

Bank of Baroda on Monday confirmed that an employee’s email account had been compromised, leading to unauthorised access to certain data.

“The incident involved compromise of an employee’s email account, resulting in unauthorised access to certain data. The matter was promptly identified, and immediate containment measures were implemented. The bank’s core banking systems were not accessed and continue to remain secure,” the lender said.

The Mumbai-based bank has initiated a forensic investigation and said it is working with relevant authorities in line with regulatory requirements.

According to reports, the alleged leak includes customer information relating to savings and current accounts, loan accounts, net banking users, non-resident Indians (NRIs), corporate banking services, and branch and ATM-related records. A listing on dark web monitoring platform Ransomware.live claimed the dataset may contain between 100,000 and 300,000 customer application forms, including photographs and identity documents submitted during account opening.

For customers, the immediate question is simple: Is your money safe, and what should you do now?

According to Reuters, the alleged leaked data includes customer information, identification documents, loan records and internal audit documents. The data was advertised on a dark web forum as a cache containing more than 700 GB of information, although the bank has not confirmed the contents or how many customers may have been affected.

Is your money safe?

At present, there is no evidence that customer deposits or banking transactions have been directly compromised.

“A data leak does not automatically mean that customer funds are at risk,” said Raheel Patel, Partner, Gandhi Law Associates.

Similarly, Rohit Jain, Managing Partner, Singhania & Co., said there is currently no indication that customer balances or the bank’s transaction systems were compromised.

“Money is therefore not known to have been stolen merely because documents were leaked. The more immediate risk is indirect fraud — exposed identity documents, customer details or loan records may help criminals conduct convincing phishing, SIM-swap, impersonation or fraudulent-credit attempts.”

Soayib Qureshi, Partner, PSL Advocates & Solicitors, echoed the view.

“A data breach may not automatically mean that money deposits are stolen because data breach typically exposes personal information. However, if stolen data is misused, money is exposed to the risk of unauthorized transactions and account takeovers.”

In other words, the biggest danger isn’t that hackers have emptied bank accounts—it’s that they may use leaked personal information to trick customers into doing it themselves.

Why should customers still be worried?

Cybercriminals often use leaked personal information to launch highly targeted phishing attacks.

If fraudsters know your:

• 
  name,
• 
  Aadhaar number,
• 
  loan amount,
• 
  account details,
• 
  or branch,

they can impersonate bank officials much more convincingly and persuade customers to share OTPs, passwords or other credentials.

The Reserve Bank of India’s customer protection framework also recognises that fraud can occur through third-party breaches and provides protection to customers who report unauthorised transactions promptly.

What should Bank of Baroda customers do now?

Lawyers and cybersecurity guidance broadly agree that customers should act immediately rather than wait for the investigation to conclude.

Raheel Patel advised customers to:

• 
  change internet and mobile banking passwords,
• 
  enable transaction alerts,
• 
  monitor account activity closely,
• 
  immediately report suspicious transactions to the bank.

Rohit Jain similarly recommends:

• 
  activating SMS and email transaction alerts,
• 
  reviewing account statements regularly,
• 
  changing reused passwords,
• 
  never sharing OTPs, PINs or passwords with anyone.

The RBI also advises customers to report unauthorised electronic banking transactions immediately. Under its framework, customers may enjoy zero liability where the loss is attributable to the bank or a third-party breach and the transaction is reported within the prescribed timelines. The burden of proving customer negligence rests on the bank.

Can the bank face regulatory action?

Possibly—but not automatically.

“If the investigation establishes that the breach resulted from inadequate cybersecurity safeguards, failure to comply with RBI’s cybersecurity and incident reporting requirements, or deficiencies in protecting customer data, the bank could face regulatory action by the RBI and liability under the Digital Personal Data Protection Act, 2023,” said Raheel Patel.

“The nature and extent of any penalty will depend on the findings of the investigation and the bank’s response to the incident.”

According to Rohit Jain, RBI could examine whether Bank of Baroda complied with its mandatory cybersecurity framework, including security controls, incident reporting and forensic response.

He noted that RBI has powers to impose monetary penalties under the Banking Regulation Act where regulatory lapses are established and that CERT-In’s binding directions require specified cyber incidents to be reported within six hours.

However, Jain cautioned that while the Digital Personal Data Protection (DPDP) Act provides for substantial penalties, its principal security, breach-notification and penalty provisions are scheduled to become enforceable only in May 2027, meaning they should not currently be viewed as the primary route for penalties in this incident.

What if money is stolen from your account?

If a fraud does occur, reporting it quickly becomes crucial.

Under RBI’s framework on unauthorised electronic banking transactions, customers who promptly notify the bank may be entitled to zero or limited liability, depending on the circumstances of the fraud and whether the customer contributed to it by sharing credentials or delaying reporting. Banks are also required to provide customers with round-the-clock channels for reporting such incidents.

As Soayib Qureshi pointed out:

Yes Bank forex card fraud (2026)

Earlier this year, around 5,000 customers using Yes Bank’s multi-currency prepaid forex cards, issued in partnership with BookMyForex, were hit by fraudulent transactions in the early hours of February 24.

Transactions worth around $280,000 were successfully processed before the fraud was detected. The bank said it blocked another 688 unauthorised transactions, preventing losses of nearly $100,000.

ICICI Bank credit card glitch (2024)

In 2024, ICICI Bank disclosed a technology glitch that affected around 17,000 newly issued credit cards.

The issue resulted in the cards being incorrectly mapped to other customers on the bank’s digital platforms, potentially allowing users to view information relating to someone else’s card. The bank subsequently resolved the issue and informed affected customers.

The 2016 debit card malware attack

One of India’s biggest banking cybersecurity incidents occurred in 2016, when malware infected systems operated by Hitachi Payment Services, which managed ATM infrastructure for Yes Bank.

The attack compromised data linked to around 3.2 million debit cards across multiple banks between May and July 2016.

Of these:

• 
  2.6 million cards were on the Visa and Mastercard networks.
• 
  Around 600,000 cards were issued on the RuPay platform.

The breach affected customers of several major lenders, including State Bank of India, HDFC Bank, ICICI Bank, Yes Bank and Axis Bank, prompting banks to replace millions of debit cards and advise customers to change their PINs.