RBI governor says IT systems of large banks strong, days after breach at BoB

The information technology (IT) systems of large Indian banks and other regulated entities are quite strong and robust, Reserve Bank of India (RBI) governor Sanjay Malhotra said on Wednesday, days after state-owned Bank of Baroda (BoB) suffered a cyber breach.

The breach reportedly exposed about 1 terabyte (TB) of customer and internal data after an employee's email account was compromised.

“They (large banks and big regulated entities) have put in place checks and balances to ensure that they are secure. We have not only guidelines and regulations, we also have supervision, which is done very regularly,” said Malhotra.

“Any shortfalls or vulnerabilities are pointed out and measures to be taken to further strengthen the systems are suggested. They are monitored and followed up to ensure that the systems are continuously safe.”

The governor said that as new threats and vulnerabilities emerge with developments in the IT sector, banks and regulated entities are continuously strengthening their security and resilience.

Mint reported on 27 July that Bank of Baroda's leaked files include branch audit reports, loan appraisal files, vigilance records and customer account-opening forms, among other documents circulating online. The bank, however, said at the time that the cyber breach was not expected to have any material impact on its operations, financial performance or business continuity.

“The bank's core business functions continued to operate normally without disruption. A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required,” it said in its 27 July statement.

The data trove is said to contain savings and current account records, loan documents, net banking user details, Aadhaar numbers, NRI and corporate banking records, customer support files, and branch- and ATM-related information.

In April, the RBI had given banks two months to submit a board-approved review of their cyber security gaps and a time-bound action plan to plug those vulnerabilities. They were also asked to formulate a comprehensive artificial intelligence (AI) governance and security framework. However, there are no updates yet on this from the regulator.

Mint reported in June that consultancy firms such as EY and Boston Consulting Group (BCG) are working with banks to identify gaps in their systems that could be exploited by AI models. Both RBI and the government have been pushing banks to boost their cyber defences. In fact, RBI deputy governor Swaminathan J. told reporters on 5 June that the issue has been engaging the attention of the government as well as financial sector inter-regulatory forums.

According to a June report by BCG and the Data Security Council of India, India recorded more than 493,000 cyberattacks and breaches targeting banks in calendar year 2025—more than double from 2022, the year when generative AI became a household name with OpenAI's ChatGPT. On average, every cyber breach cost $2.5 million and took 263 days to resolve.