TripleX Leaks 1TB Bank of Baroda Data Free on Dark Web — Aadhaar, KYC, Loan Records Confirmed in Samples; Email Compromise Vector Admitted

Emerging extortion group TripleX listed India's second-largest public-sector bank, Bank of Baroda, on Ransomware.live on July 24, publishing approximately 1TB of data for free download including customer KYC forms, Aadhaar and PAN copies, loan files, branch audit records, and internal communications. The bank confirmed the root cause was a compromised employee email account granting unauthorized access to internal files, while maintaining core banking systems were unaffected. TripleX previously breached Indonesia's PT Bank Negara Indonesia in May 2026, establishing a pattern of targeting state-owned banks in Asia with public data dumps rather than ransom demands — making negotiation-based containment impossible.

TripleX previously breached Indonesia's PT Bank Negara Indonesia in May 2026, establishing a pattern of targeting state-owned banks in Asia with public data dumps rather than ransom demands — making negotiation-based containment impossible.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.