Security

India’s .bank.in Domains Are Leaking Secrets — And It Shouldn’t Be This Easy An anonymised security scan of RBI’s banking TLD reveals env files, debug endpoints, and framework metadata exposed in plain sight. What happened Prompted by a recent post on X noting that sensitive files on .bank.in domains were trivially accessible, I ran a systematic scan across the entire .bank.in namespace. Scope: 1,393 unique .bank.in hostnames — built from prior DNS/CT logging, Wayback Machine CDX expansion, and HackerTarget subdomain enumeration. Every major bank, cooperative bank, payments bank, and DCCB with a .bank.in domain was covered. ...

15,774 Files: The Inside Story of the Bank of Baroda Data Breach On July 26, 2026, the Triple X ransomware group’s Tor hidden service went live with a recursive directory listing of what appears to be Bank of Baroda’s internal Microsoft SharePoint / Windows file server. No authentication required — anyone with the Tor browser could browse 15,774 files across 2,671 subdirectories as if they were sitting at a branch terminal. ...

BoB Data Breach: Your 8-Step Action Plan Bank of Baroda customers are facing the largest breach of an Indian PSU bank’s internal systems ever documented. On July 26, the Triple X ransomware group’s Tor hidden server went live with the complete directory tree of Bank of Baroda’s internal SharePoint file server — 15,774 files across 2,671 directories, containing everything from individual customer CKYC records to database login credentials to the bank’s complete vulnerability assessment database. ...

BoB’s 15,774-File Leak: Anatomy of India’s Worst PSU Bank Breach On the morning of July 26, a Tor hidden service went live carrying what may be the most comprehensive single breach of an Indian public sector bank’s internal systems ever documented. 15,774 files. 2,671 subdirectories. No authentication required to access any of it. The Triple X ransomware group — a new actor first detected in May 2026 — published the complete directory tree of Bank of Baroda’s internal SharePoint / Windows file server. Our team crawled the dump server for 995 seconds across 925 HTTP fetches with zero errors. This analysis is based on the metadata alone: file names, directory paths, and structure. We downloaded nothing. ...