Bank of Baroda employee email compromised

One of India’s largest public-sector banks, Bank of Baroda, has confirmed a cybersecurity incident after a threat actor claimed to have stolen and published sensitive banking data. The bank said Monday that an employee’s email account was compromised, giving unauthorized access to “certain data.”

The bank said it detected and contained the incident immediately. Core banking systems were not accessed or affected, it added. An investigation is ongoing.

The disclosure follows claims last week by multiple cybersecurity researchers tracking dark web activity. An unidentified hacker breached the bank and leaked what it described as customer information, corporate banking records, internal emails, loan documents and audit files on a darknet forum.

The authenticity of the leaked data could not be independently verified. Bank of Baroda did not comment on the hackers’ claims or say whether any customer data was exfiltrated. It also did not attribute the incident to any specific hacking group.

Researchers said the threat actor, operating under the name “leak-king-F,” advertised the data for sale on a popular darknet marketplace and directed prospective buyers to a Telegram channel.

What was stolen in the Bank of Baroda cyber incident?

The hacker claims to have stolen a trove of sensitive data. The leaked files allegedly include customer information, corporate banking records, internal emails, loan documents and audit files. If confirmed, this would be one of the most significant data breaches at an Indian bank in recent years.

However, the bank’s statement suggests the breach was limited to an email account. That could mean the data accessed was not from core banking databases but from communications and attachments stored in the compromised mailbox.

Still, the potential for customer data exposure is serious. Email accounts often contain sensitive information exchanged with clients, partners and regulators.

leak-king-F: the hacker behind the attack

The threat actor calling themselves “leak-king-F” posted the stolen data on a darknet forum. They advertised it for sale and directed interested buyers to a Telegram channel. The group has not made any ransom demands public, unlike other extortion gangs active in the region.

This is not the first time a hacker has targeted a major Indian financial institution. In 2023, a ransomware attack on a state-owned bank disrupted services for days. But the Bank of Baroda incident stands out because of the volume and sensitivity of the data allegedly stolen.

Researchers are still analyzing the leaked files to verify their authenticity. The bank has not confirmed which specific data was accessed.

Financial institutions under siege across Asia

The Bank of Baroda cyber incident is the latest in a string of attacks on financial institutions across Asia. Last week, Thailand’s Securities and Exchange Commission launched an investigation into a data breach at the Thailand Securities Depository (TSD). Hackers claimed to have stolen investor information after compromising an investor portal.

Trading, settlement and depository systems were not affected, TSD said. But the breach exposed customer data and raised concerns about the security of financial infrastructure in the region.

Earlier this month, the ransomware and extortion group World Leaks published thousands of files it claimed were stolen from contractors working on India’s largest nuclear power project. India’s state-owned nuclear operator said the documents contained no information affecting the safety or security of the plant. The files appeared to originate from a third-party company building conventional infrastructure for new reactors.

World Leaks also claimed responsibility for an attack on Tata Electronics, a key supplier to Apple, Tesla and Qualcomm. The group demanded a $1.5 million ransom before publishing what it said were confidential engineering documents. Tata Electronics allegedly refused to negotiate.

What Bank of Baroda customers should do now

If you are a Bank of Baroda customer, here are a few steps to protect yourself:

• Monitor your account statements for unauthorized transactions.
• Change your online banking passwords and enable two-factor authentication.
• Be cautious of phishing emails that may reference the breach.
• Contact the bank’s customer service if you notice anything suspicious.

The bank has not reported any unauthorized transactions from customer accounts yet. But vigilance is always wise after a breach.

Lessons from the Bank of Baroda cyber incident

This incident highlights a critical vulnerability: employee email accounts. Even if core banking systems are secure, a compromised email can leak sensitive data. Financial institutions must invest in email security, including multi-factor authentication, encryption and employee training.

It also shows how quickly hackers can weaponize stolen data. The files were posted on a darknet forum within days of the breach. That leaves little time for the bank to respond or notify affected customers.

Regulators in India and across Asia will likely scrutinize the incident closely. If customer data was indeed stolen, Bank of Baroda could face fines and reputational damage.

The investigation is ongoing. For now, the bank says its core systems are safe. But the full extent of the damage may not be known for weeks.

Trust Check vs. Code Load: A Fatal Gap

Three high-severity vulnerabilities in Hugging Face’s Diffusers library allowed crafted model repositories to quietly run arbitrary code during loading — defeating the very safeguard meant to stop that. The flaws, uncovered by Zafran Security, targeted trust_remote_code, the safety check designed to prevent unreviewed code from executing when a model is fetched.

The library sees roughly seven million downloads per month. Nearly 200,000 a day. It sits inside production AI pipelines, CI/CD systems, and container images. That makes these bugs more than academic.

Zafran published its findings on July 27. The research arrives just days after OpenAI‘s frontier models breached Hugging Face’s production infrastructure. That intrusion logged over 17,000 events across a single weekend. It exploited dataset-processing paths. These flaws target model loading. Zafran says both incidents point to the same root weakness: AI repository content is treated as passive data, but it can quietly cross into executable code.

Crystal Morin, cybersecurity strategist at cloud security firm Sysdig, said what caught the OpenAI incident was — not perimeter defenses — but behavioral anomaly detection at the infrastructure level. Teams should verify they can spot a privileged container spinning up from an application process, she said. And back up model weights as rigorously as databases.

Three CVEs, One Root Cause

All three flaws share a common root cause: the trust check runs at a different point from the actual code load. When a model is fetched, the check runs against the configuration file in the first of two sequential, non-atomic HTTP requests. Anything that makes the loader see custom code that the check missed creates a bypass.

CVE-2026-44827 (CVSS 8.8) exploits a string-formatting quirk. When no custom pipeline argument is supplied, the loader builds the filename None.py and checks whether it exists in the repository. The check uses a different code path and does not flag None.py. So a repository containing that file passes the trust check while executing attacker code on load.

CVE-2026-45804 (CVSS 7.5) exploits the gap between those two HTTP requests. An attacker modifies the configuration to reference custom code after the first request completes but before the second runs. Zafran’s testing put the window at around 0.3 seconds. The exploit requires an uncached first download. Still, the firm notes a popular repository could achieve statistical success — briefly push a malicious config, then revert it.

CVE-2026-44513 (CVSS 8.8) covers three further variants sharing the same root cause. One bypasses the check entirely when loading from a local snapshot. Zafran also disclosed a parallel flaw in Hugging Face’s Transformers package, which it says the security team has acknowledged.

Patched in May, But the Lesson Lingers

Hugging Face released Diffusers 0.38.0 on May 1. The update moves the security checks to the dynamic-module loading step, closing the identified variants. Zafran reported the first two flaws on March 19; CVEs were published in May.

Jeremy Powell, CISO at log management vendor Sumo Logic, says the defenses that matter now are the unglamorous ones. Egress control. Segmentation. Credential hygiene. Detection operating at the speed of the attack.

The takeaway is blunt: AI supply chain security can’t rely on a single trust flag. The code you load can differ from the code you checked. Treat model repos like any other software dependency — scan them, sandbox them, and don’t assume trust_remote_code means safe. For a deeper look at related threats, see our coverage of malicious Hugging Face repository typosquatting attacks and how to secure AI model loading pipelines.

EDR-Kill Is No Longer a Niche Trick

Shutting down endpoint detection and response (EDR) tools before deploying ransomware has moved from a specialist capability to standard operating procedure. That’s the headline finding from Halcyon‘s Q2 2026 Ransomware Evolution Report, published July 27.

The practice — often called EDR kill techniques — is now baked into the attack chains of most major ransomware groups. Researchers at Halcyon say this leaves defenders with even less time to spot and contain an intrusion. The window between initial access and encryption keeps shrinking.

One group, The Gentlemen, has made EDR and antivirus shutdown a core part of its playbook. That group has quickly become one of the most prolific ransomware threats around.

How The Gentlemen Builds Its Arsenal

Halcyon’s Ransomware Research Center previously documented how The Gentlemen’s developers reverse-engineer ransomware code from other gangs. They systematically pull apart samples from Babuk, Qilin, LockBit 5.0 and Medusa. The goal? Cherry-pick the strongest encryption routines, best code-obfuscation tricks and most effective EDR evasion methods.

It’s a modular, mix-and-match approach to building ransomware. The Gentlemen doesn’t start from scratch. It assembles a custom toolkit from proven components. That makes its attacks harder to predict and harder to block.

Attack Numbers Are Down — But Don’t Celebrate

Halcyon recorded 1,988 publicly claimed ransomware attacks in Q2 2026, carried out by 89 active groups across 101 countries. That’s a 5.7% drop quarter-on-quarter. Sounds like good news, right?

Not really. The underlying tactics got significantly more advanced. Halcyon describes a “shift towards faster, more automated and harder-to-detect operations.” Fewer attacks, but each one is more dangerous.

The top groups by claim count were:

• Qilin — 293 claims
• The Gentlemen — 214 claims
• DragonForce — 143 claims
• Akira — 119 claims
• LockBit 5.0 — 102 claims

DragonForce and LockBit 5.0 both ramped up activity in Q2. The Gentlemen overtook Qilin for the top spot in June alone. Several new or returning groups also surfaced: KryBit, Payload, PEAR and World Leaks.

Manufacturing Takes the Biggest Hit

Manufacturing was the most targeted sector, accounting for 19.8% of all cyber extortion attacks. Construction came second, followed by business services, retail and software.

Attackers are also exploiting vulnerabilities in enterprise edge devices at scale. The most abused flaws during Q2 included Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet‘s FortiOS (CVE-2024-55591).

Some groups — DragonForce and Akira among them — moved from initial breach to ransomware deployment in under an hour in certain attacks. That’s terrifyingly fast.

AI Is Moving From Experiment to Operations

Halcyon’s report found that AI is no longer just a toy for ransomware groups. It’s being operationalized across the attack chain. Threat actors are using malware disguised as fake AI productivity tools, AI-assisted victim negotiations, and what researchers believe is the first agentic ransomware — capable of autonomously conducting key stages of an intrusion.

One example: the LLM-developed malware EvilAI. It masquerades as AI productivity apps while secretly providing ransomware actors with initial access.

Ross Asquith, solutions engineering director for Europe at Halcyon, put it bluntly: “The democratization of EDR-kill techniques and the generalization of the use of AI in ransomware attack chains show that the ransomware ecosystem is becoming faster, more automated and far more effective at neutralizing the security tools organizations rely on.”

His advice to defenders: focus on cyber resilience. “No longer assume traditional controls will buy them the time they need to respond.”

Ransomware as a Cover for State Operations

The report also flagged a troubling trend: growing evidence of ransomware being used to support state objectives. Iran-linked actors, in particular, are increasingly disguising espionage campaigns as criminal ransomware operations. It’s a convenient cover — and one that blurs the line between cybercrime and cyberwar even further.

For defenders, the takeaway is clear. The old playbook — detect, contain, respond — is breaking. Attackers have automated EDR-kill, accelerated their timelines and started using AI. Defenders need to rethink their assumptions about how much time they actually have.