Bank of Baroda Data Leak: Beyond the Email Compromise | RavenMail This website uses cookies.

Learn more<br>AcceptDecline

Bank of Baroda Data Leak: Beyond the Email Compromise<br>Aug 03, 2026<br>•12 min read<br>•News & Analysis

*:first-child]:!mt-0" id=post-body>The Indonesia Connection<br>When an emerging ransomware group first appears, it rarely makes global headlines. Its early victims often pass with little scrutiny outside threat intelligence circles. That appears to be the case with TripleX , a relatively new extortion group that surfaced in 2026. Before it was linked to the alleged 1 TB Bank of Baroda data leak , the group had already claimed responsibility for targeting PT Bank Negara Indonesia , hinting at an unusual preference for large financial institutions . While the earlier incident received limited public analysis, the Bank of Baroda breach has put TripleX firmly in the spotlight and raised important questions about how the group operates.Over the past week, cybersecurity publications have extensively covered (here, here & here) the publicly known facts: a compromised employee email account, the alleged exfiltration of hundreds of gigabytes of sensitive banking data, and the publication of that data on TripleX's leak site.These reports answer what happened, but they leave several technical questions unexplored.How does the compromise of a single mailbox result in nearly a terabyte of sensitive data being exposed?What made this attack different from conventional ransomware?Is there more to what meets the eye?What's the financial impact of this attack?Incident Overview & Attack Vector<br>On July 27, 2026, Bank of Baroda officially acknowledged a cybersecurity incident  The bank confirmed that an employee’s email account was compromised, leading to unauthorized access to certain internal data .Although the bank immediately implemented containment measures and affirmed that its core banking transactional systems (Finacle) remained secure and uncompromised, the incident highlights a critical failure in authorization and identity access governance.Publicly available investigations indicated that the exfiltrated data likely originated from shared folders and collaborative document repositories accessible through the compromised employee's permissions. One plausible explanation is that the compromised identity possessed broad access to shared repositories, the attacker was able to reach and exfiltrate over 92,000 files across 9,783 directories.  Attack chain of Bank of Baroda & PT BankScope of the Exfiltrated Data The leaked dataset represents a substantial exposure of personally identifiable information (PII) and highly sensitive operational bank documentation. The leaked archive appears to contain the presence of the following records.Customer application forms (estimated between 100,000 and 300,000 records) including customer photographs and identity documents.Personally Identifiable Information such as Aadhaar numbers, Permanent Account Numbers (PAN), passport-size photographs, and proofs of address.Operational financial documents, including savings/current account records, NetBanking user details, and loan-related applications .Highly sensitive internal audit reports, branch-specific audit files, loan appraisal documents, vigilance investigation records, and internal spreadsheets containing bank operations intelligence.These leaked dataset functions as a "ready-made KYC kit" that could be easily weaponized by downstream threat actors to conduct identity theft, fraudulent loan applications, SIM-swap attacks, or to construct highly targeted, AI-driven phishing campaigns. Threat Actor Profile and Dark Web Infrastructure<br>TripleX operates as a data-extortion collective rather than a traditional ransomware cartel that utilizes encryption payloads. Rather than rendering systems inoperable and demanding payment for decrypters, TripleX aims to exfiltrate bulk datasets silently and threaten public exposure.In this specific campaign, the group made the entire dataset publicly available for free download, citing "weak passwords" and "security failings" at Bank of Baroda as their primary justification. The group has established a history of targeting major financial entities .In May 2026, TripleX successfully breached PT Bank Negara Indonesia (a state-owned Indonesian bank), exfiltrating approximately 2 TB of sensitive contracts, identity files, and internal documents, which were similarly published online.Below are the key indicators of compromise (IoCs) representing the Tor-based network infrastructure used by TripleX to disseminate the exfiltrated datasets Indicator Type Value Context Tor Domain (onion) ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid[.]onion Primary TripleX Data Leak Site (DLS) Tor Domain (onion) 6qqz6m3b6htudohg2mlf5gdcalonxy3sh5g4dix4mpyirjcgelqqufad[.]onion Secondary download/hosting mirror used for storing massive file repositories<br>Mechanism of the Perimeter Bypass and Access<br>As per...