Bank of Baroda claims cyber cover after data breach

Mumbai: Bank of Baroda has notified a claim under its cyber insurance policy after a data breach allegedly exposed nearly 1 terabyte of customer information on the darknet, according to people familiar with the matter. The bank has informed lead insurer National Insurance under a cyber insurance programme with a total cover of about ₹750 crore.

The claim has been lodged as a notice of loss, allowing insurers to begin assessing the incident while forensic investigations are underway. The eventual payout, if any, will depend on the extent of financial losses, regulatory action, business disruption and third-party liabilities arising from the breach.

Also Read | Bank of Baroda data reportedly leaked on dark web


"The claim has already been reported. At this stage, it is only an intimation while the forensic investigation is underway," a person aware of the development said. Loss limit is about ₹300 crore, another source said.

The cyber insurance programme carries an annual premium of around ₹6 crore and is backed by multiple domestic insurers and reinsurers, with National Insurance acting as the lead insurer responsible for coordinating claims.

The alleged breach was reported to insurers after being notified to the Indian Computer Emergency Response Team (CERT-In). Cybersecurity specialists and forensic investigators are now examining the incident to determine the source of the breach, assess the extent of data exposure and contain any further compromise.

In a statement posted on X, Bank of Baroda acknowledged the incident, saying an employee's email account had been compromised, resulting in unauthorised access to certain data.

Also Read | Bank of Baroda, India’s second-biggest state lender, aims to double size in 5 years

"The matter was promptly identified and immediate containment measures were implemented. The bank's core banking systems were not accessed and continue to remain secure. A comprehensive forensic investigation has been initiated and the bank is working closely with the relevant authorities in accordance with applicable regulatory requirements," BoB said.

Insurance industry executives said the initial costs relate to forensic investigations, which typically range between ₹50 lakh and ₹4 crore depending on the complexity of the attack, with most incidents costing around ₹1-3 crore. However, they said forensic expenses are often only a small part of the overall loss.

"The real financial exposure arises if the breach leads to prolonged business interruption, customer litigation or regulatory action," a cyber insurance expert said.

A prolonged disruption to banking operations could trigger business interruption claims, while additional costs may arise from replacing compromised debit or credit cards, notifying affected customers, legal defence, crisis communication and restoring IT systems.

The incident could also invite scrutiny from multiple regulators. Penalties under the Information Technology Act can extend up to ₹5 crore in certain cases, while listed companies may also face regulatory action if cybersecurity lapses are established.

Also, certain regulatory defence costs and cyber liabilities may be covered under the insurance policy. If regulators initiate proceedings against directors or senior management over governance failures, the incident could also give rise to claims under directors' and officers' liability insurance.