Extortion group Triple X claims 1TB data leak from India's Bank of Baroda (2026)

On 24 July 2026, a financially motivated extortion group calling itself Triple X listed Bank of Baroda — one of India's largest state-owned banks — on its dark-web leak site, claiming to have exfiltrated roughly 1 terabyte of data. The listing thrust one of India's systemically important lenders into a public extortion dispute over the scope and sensitivity of the material allegedly taken.

What was claimed

According to the group's postings and subsequent reporting, the dataset purportedly included customer KYC (know-your-customer) forms, Aadhaar and PAN identifiers, phone numbers, loan applications, non-resident Indian (NRI) banking records, corporate banking records, and internal branch audit reports drawn from multiple branches across India. If accurate, the combination of national identity numbers with financial account details would be especially damaging, giving fraudsters the raw material for identity theft and account takeover.

The bank's response

On 27 July 2026, Bank of Baroda confirmed that an employee's email account had been compromised and that unauthorised access to certain internal files had taken place. The bank maintained that its core banking infrastructure was never touched and that customer funds were not at risk. Reporting on the incident attributed the initial foothold to an ordinary weakness — a weak password on one of the bank's systems — rather than a sophisticated exploit.

Why it matters

Triple X, first observed in mid-2026 and focused on the financial and legal sectors, follows the now-familiar "name-and-shame" extortion playbook: publish a claim, apply reputational pressure, and negotiate. For a state-owned bank the size of Bank of Baroda, even an unverified 1TB claim carries regulatory and reputational weight, and the episode is a reminder that a single compromised mailbox — reached through a weak password — can open a path to sensitive internal data at an institution of national importance.