Bank of Baroda has been hit by a major cyberattack, leading to leak of customer data and corporate banking details across several branches on the dark web.

The breached data includes customer details, identification documents and loan papers, said Srikanth L, cybersecurity activist and founder of Cashless Consumer.  

The state-run lender said on Monday that the breach originated from an employee’s email account, which resulted in “unauthorised access to certain data”.

The bank’s core banking systems were, however, not accessed and continue to remain secure, it stated.

The breach, according to Srikanth, happened across 1,088 branches covering almost all the states of the country.

“At least 90,000 files minimally got leaked. It includes personal data, branch data and bank corporate and IT data,” he said.

Bank of Baroda said it had started a comprehensive forensic investigation and was working with relevant authorities in accordance with applicable regulatory requirements, after promptly taking containment measures.

According to Srikanth, the data was advertised on a dark web site as a cache on Saturday containing more than 700 gigabytes of information based on metadata analysis of the site. 

The data breach included account details, Aadhaar card details of customers and other internal documents.

A hacking group claims claims to have made available 1TB of sensitive data on the dark web.