Bank of Baroda Data Breach and India's Cybersecurity Framework

#GS-3 #Science & Technology #Cyber Security #Current Events #National #IT & Computers

Why in News

Public sector lender **Bank of Baroda** started a forensic investigation after an alleged data breach exposed nearly **1 TB** of customer information on the dark web.
The bank clarified that its main core banking servers remain completely safe and uncompromised.
Recent cyber incidents such as the **Tata Electronics ransomware attack (2026)**, **BSNL data breach (2024)**, **WazirX crypto heist (2024)**, **ICMR data leak (2023)**, and **Air India cyberattack (2021)** highlight growing gaps in India's cyber preparedness.

The **Surface Web** includes all public websites that regular search engines can easily index and show to users.
The **Deep Web** contains private online areas like personal email accounts, bank login portals, and internal corporate databases that require password access.
The **Dark Web** forms a tiny, hidden section of the Deep Web that people can visit only using specialized software like the **Tor browser**.
This hidden network masks user location and IP addresses, which turns it into a hub for trade in stolen data and cybercrimes.

**CERT-In** acts as the central national agency that manages major cyber threats like hacking attempts and phishing attacks.
Financial organizations must report any critical cyber security incident to **CERT-In** within **6 hours** of discovery.
**RBI's Cyber Security Framework for Banks** requires every bank to maintain a board-approved policy, create a **Cyber Crisis Management Plan (CCMP)**, and inform regulators about unusual incidents immediately.
The **Digital Personal Data Protection (DPDP) Act, 2023** forces entities like banks to protect personal user data or face heavy financial penalties.
Section 43A and Section 66 of the **IT Act, 2000** punish unauthorized system access and failure to safeguard sensitive personal information.