The compromised data allegedly includes retail and corporate banking records, customer account and loan details, net banking records, non-resident Indian and corporate banking data, and information related to branches and ATMs.
The Mumbai-based lender said it initiated a comprehensive forensic investigation into the incident and is working closely with relevant authorities in accordance with applicable regulatory requirements.
The incident is the latest in a series of cyberattacks and data breaches involving Indian organisations in recent years. These attacks have exposed millions of customer records, sensitive corporate information and, in some cases, intellectual property.
Here is a look at some of the biggest cyberattacks and data breaches involving Indian organisations in recent years.
Tata Electronics (2026)
Tata Electronics (2026)
In June 2026, Tata Electronics confirmed a cybersecurity incident after ransomware group World Leaks claimed to have stolen and leaked more than 200,000 files, amounting to over 630 GB of data, from the company.
The allegedly stolen data included documents linked to Apple and Tesla, including engineering files, component and supplier details, factory data and material specifications. Reports also claimed that the breach exposed photographs of Apple’s unreleased iPhone 18 Pro model.
The incident is being investigated by the government.
BSNL (2024)
BSNL (2024)
State-owned telecom operator Bharat Sanchar Nigam Ltd (BSNL) came under scrutiny in 2024 after a hacker allegedly accessed around 278 GB of the company’s data and offered it for sale on a cybercrime forum.
The Centre later confirmed in a Lok Sabha reply that the Indian Computer Emergency Response Team (CERT-In) had reported a possible intrusion and data breach at BSNL on May 20, 2024.
The leaked dataset reportedly contained sensitive information related to the telecom operator’s network and subscribers, including International Mobile Subscriber Identity numbers, SIM details, Home Location Register data, DP card data and DP security key data.
WazirX (2024)
WazirX (2024)
WazirX, one of India’s largest cryptocurrency exchanges, suffered one of the country’s biggest cyberattacks in 2024, when hackers allegedly stole more than $230 million worth of users’ crypto assets. The stolen assets accounted for nearly half of the platform’s reserves.
The exchange described the incident as a “force majeure” event beyond its control and temporarily suspended rupee and cryptocurrency withdrawals.
WazirX said its preliminary investigation pointed to a cyberattack involving one of its multi-signature wallets. It suspected that the transaction payload had been manipulated to transfer control of the wallet to the attacker.
The attack resulted in one of the largest losses suffered by an Indian cryptocurrency platform.
boAt (2024)
boAt (2024)
Consumer electronics company boAt came under scrutiny in 2024 after a hacker claimed to have leaked the personal data of more than 7.5 million customers on the dark web.
The dataset, reportedly around 2 GB in size, allegedly contained customer names, addresses, phone numbers, email addresses and customer IDs. It was reportedly offered for sale on a hacking forum.
The company acknowledged reports of the breach and said it had launched a comprehensive investigation. It added that safeguarding customer data remained its top priority.
ICMR (2023)
ICMR (2023)
The Indian Council of Medical Research (ICMR) was at the centre of one of India’s biggest alleged data breaches in 2023, after the personal information of more than 815 million Indians was reportedly offered for sale on the dark web.
The leaked dataset allegedly included Aadhaar and passport details, along with names, phone numbers and addresses.
The breach prompted a multi-agency investigation. The Delhi Police later arrested four people in connection with the case.
Air India (2021)
Air India (2021)
Air India disclosed in 2021 that a cyberattack had compromised the personal data of about 4.5 million customers worldwide.
The breach exposed passenger names, passport details, ticket information, frequent-flyer data and some credit card information stored between August 2011 and February 2021.
The airline said the attack had targeted data hosted by its passenger service provider. It clarified that card verification value numbers were not stored on the affected servers.
MobiKwik (2021)
MobiKwik (2021)
Fintech company MobiKwik came under scrutiny in 2021 after reports alleged that the personal data of 110 million users had been breached and circulated online.
The leaked information reportedly included know-your-customer details, phone numbers, email addresses and payment card information.
The Reserve Bank of India directed the company to investigate the alleged breach and warned of regulatory action if security lapses were found. MobiKwik, however, denied that its systems had been compromised.
