Synopsis

Bank of Baroda has filed a preliminary claim under its cyber insurance policy after a suspected data breach exposed nearly 1 TB of customer data on the darknet. The claim, lodged with lead insurer National Insurance Company, is currently an intimation of loss while forensic investigations continue.

Listen to this article in summarized format

Bank of Baroda can notify a claim under its cyber insurance policy after a data breach allegedly exposed nearly 1 terabyte of customer information on the darknet, according to people familiar with the matter. The bank can inform lead insurer National Insurance Company under a cyber insurance programme with a total cover of about Rs 750 crore, if data breach leads to financial loss.

The claim could be lodged as a notice of loss, allowing insurers to begin assessing the incident while forensic investigations are underway. The eventual payout, if any, will depend on the extent of financial losses, regulatory action, business disruption and third-party liabilities arising from the breach.

Also Read|Bank of Baroda data reportedly leaked on dark web

"The claim has already been reported. At this stage, it is only an intimation while the forensic investigation is underway," a person aware of the development said.

However, the bank in its response said that neither the bank nor its customers have suffered any financial loss arising from the incident. Accordingly, there has been no requirement or basis for notifying or lodging any claim under the Bank's cyber insurance programme, it added.

Payout depends on extent of loss Forensic investigations underway; core banking system not accessed, says bank

The cyber insurance programme carries an annual premium of around Rs 6 crore and is backed by multiple domestic insurers and reinsurers, with National Insurance acting as the lead insurer responsible for coordinating claims.

The alleged breach was reported to insurers after being notified to the Indian Computer Emergency Response Team (CERT-In). Cybersecurity specialists and forensic investigators are now examining the incident to determine the source of the breach, assess the extent of data exposure and contain any further compromise.

Also Read | Bank of Baroda, India’s second-biggest state lender, aims to double size in 5 years

In a statement posted on X, Bank of Baroda acknowledged the incident, saying an employee's email account had been compromised, resulting in unauthorised access to certain data.

"The matter was promptly identified and immediate containment measures were implemented. The bank's core banking systems were not accessed and continue to remain secure. A comprehensive forensic investigation has been initiated and the bank is working closely with the relevant authorities in accordance with applicable regulatory requirements," BoB said.

Insurance industry executives said the initial costs relate to forensic investigations, which typically range between Rs 50 lakh and Rs 4 crore depending on the complexity of the attack, with most incidents costing around Rs 1-3 crore.

However, they said forensic expenses are often only a small part of the overall loss.

"The real financial exposure arises if the breach leads to prolonged business interruption, customer litigation or regulatory action," a cyber insurance expert said.

A prolonged disruption to banking operations could trigger business interruption claims, while additional costs may arise from replacing compromised debit or credit cards, notifying affected customers, legal defence, crisis communication and restoring IT systems.

The incident could also invite scrutiny from multiple regulators. Penalties under the Information Technology Act can extend up to Rs 5 crore in certain cases, while listed companies may also face regulatory action if cybersecurity lapses are established. Also, certain regulatory defence costs and cyber liabilities may be covered under the insurance policy. If regulators initiate proceedings against directors or senior management over governance failures, the incident could also give rise to claims under directors' and officers' liability insurance.