India's Biggest Cyberattacks
Every major cyberattack leaves behind two things:
A victim and a lesson.
The recent Bank of Baroda cybersecurity incident is another reminder that no organization is immune to cyber threats. According to the bank, the incident involved a compromised employee email account that resulted in unauthorized access to certain data, while its core banking systems remained secure. A forensic investigation is underway.
But this isn't an isolated event.
Over the past few years, several major Indian organizations have experienced cyber incidents affecting banking, healthcare, aviation, manufacturing, cloud infrastructure, cryptocurrency, and critical infrastructure.
The common question isn't:
"Who was attacked?"
It's:
"What can we learn from these attacks?"
Major Cyber Incidents in India
| No. | Victim | Incident | Lesson |
|---|---|---|---|
| 1 | Bank of Baroda (2026) | An employee email account was reportedly compromised, resulting in unauthorized access to certain data that was later reportedly advertised on the dark web. Bank of Baroda stated that its core banking systems were not compromised. | Protect identities. Use MFA, secure email systems, monitor suspicious logins, and detect account compromise as early as possible. |
| 2 | Tata Electronics (2026) | A ransomware group claimed to have stolen hundreds of thousands of files, including documents allegedly related to major global customers. | Modern ransomware is also a data-theft business. Backups are important, but organizations also need data protection, network segmentation, monitoring, and incident response. |
| 3 | Kudankulam Nuclear Project Data Leak (2026) | A ransomware group published files reportedly linked to the Kudankulam project. The reported breach involved a third-party server, while officials stated that the plant's core nuclear systems were not affected. | Third-party infrastructure is part of your attack surface. Critical organizations must protect contractor environments, segregate sensitive systems, restrict access, and continuously monitor third-party connections. |
| 4 | Angel One (2025) | Angel One reported that some of its AWS resources were compromised after its dark-web monitoring partner alerted the company to unauthorized access to client data. The company changed affected AWS and application credentials and stated that client securities, funds, and credentials were not impacted. | Cloud infrastructure is part of your attack surface. Secure IAM credentials, enforce least privilege, continuously monitor cloud resources, rotate compromised credentials, and maintain threat monitoring. |
| 5 | WazirX (2024) | More than $230 million worth of cryptocurrency was stolen after attackers compromised a multi-signature wallet environment. | Protect privileged transactions. Strengthen key management, transaction approval mechanisms, privileged access controls, and continuous monitoring of high-value transactions. |
| 6 | ICMR Data Leak (2023) | Personal data reportedly linked to more than 815 million individuals was advertised online, raising significant privacy concerns. | Sensitive data requires strong protection. Use access controls, encryption, data minimization, monitoring, and strict data governance. |
| 7 | Air India (2021) | Personal information of approximately 4.5 million passengers was exposed through a compromise involving a third-party service provider. | Third-party vendors are part of your attack surface. Organizations must assess vendor security, restrict third-party access, and continuously monitor supply-chain risks. |
| 8 | Domino's India Data Leak (2021) | Reports indicated that a large database containing customer order information and other personal details was exposed, with estimates reaching approximately 18 crore order records. Reports also alleged exposure of payment-card information. | Minimize the data you store and protect what you retain. Apply encryption, strict access controls, data-retention policies, and continuous monitoring to customer databases. |
| 9 | BigBasket Data Breach (2020) | Data belonging to more than 20 million users was reportedly exposed, including email addresses, phone numbers, addresses, dates of birth, and other account information. The stolen data was reportedly offered for sale online. | Protect databases, not just applications. Secure database configurations, apply vulnerability management, enforce access controls, encrypt sensitive information, and monitor for unauthorized access. |
| 10 | Justdial Data Exposure (2019) | Security researchers reported that APIs associated with Justdial exposed personal information of potentially millions of users, including names, email IDs, phone numbers, addresses, and other profile information. Justdial disputed that this constituted a data breach. | APIs are part of the attack surface. Implement authentication, authorization, rate limiting, API security testing, and strict controls over exposed endpoints. |
| 11 | SBI Data Exposure (2019) | Reports identified an unprotected server associated with SBI's SBI Quick service that could expose customer-related information. SBI denied that its customer data had been breached and said the issue was a process/configuration weakness that was subsequently fixed. | Misconfiguration can be as dangerous as sophisticated hacking. Secure configurations, authentication, access controls, continuous monitoring, and regular security audits are essential. |
| 12 | Aadhaar Data Exposure (2018) | Reports alleged that unauthorized individuals could access Aadhaar-related information through a service used for grievance redressal. UIDAI denied that the central Aadhaar database had been breached. | Sensitive identity data requires strict access controls. Even legitimate access mechanisms can become security risks when authentication, authorization, or monitoring is weak. |
Common Lessons From These Attacks
Although these incidents affected different industries and involved different attack techniques, they reveal several common cybersecurity fundamentals:
1. People Are Part of the Attack Surface
A compromised employee account can become an entry point for attackers.
Strong passwords alone aren't enough. Organizations need MFA, identity monitoring, phishing protection, conditional access, and security awareness training.
2. Third Parties Can Become Attack Paths
Air India and the Kudankulam incident demonstrate why organizations must consider vendors, contractors, and service providers when assessing their security posture.
Your security is also influenced by the security of the organizations connected to you.
3. Cloud Security Is Critical
The Angel One incident highlights the importance of protecting cloud infrastructure.
Organizations should secure IAM, API keys, access tokens, cloud storage, privileged accounts, and administrative interfaces while continuously monitoring cloud activity.
4. Data Is a High-Value Target
Attackers don't always need to destroy a system.
Sometimes, simply stealing customer information is enough to create financial, legal, and reputational damage.
Organizations should follow data minimization, encryption, access control, classification, retention, and monitoring principles.
5. Misconfiguration Can Be Enough
Attackers don't always need an advanced zero-day vulnerability.
An exposed server, excessive permissions, unsecured API, weak authentication, or improperly configured cloud resource can provide enough access to sensitive information.
6. Detection Matters as Much as Prevention
No security architecture is perfect.
That's why organizations need SIEM, EDR/XDR, threat intelligence, SOC monitoring, and incident response capabilities to identify suspicious activity as quickly as possible.
7. Backups Don't Solve Everything
Backups are essential for recovering from ransomware and destructive attacks.
But backups don't prevent data theft, credential compromise, or information exposure.
Organizations need both resilience and data protection.
What Organizations Should Do
The lessons from these incidents can be converted into practical security controls:
Enable MFA across business and privileged accounts.
Implement least-privilege access.
Continuously monitor authentication and user activity.
Secure cloud environments and IAM configurations.
Perform regular Vulnerability Assessments and Penetration Testing (VAPT).
Secure APIs and publicly exposed applications.
Encrypt sensitive information.
Monitor third-party and vendor access.
Maintain tested and isolated backups.
Deploy SIEM and EDR/XDR for continuous monitoring.
Conduct regular phishing and security-awareness training.
Maintain and test an Incident Response Plan.
Regularly review configurations for exposed systems and services.
Final Thoughts
Cybersecurity isn't about believing an attack will never happen.
It's about ensuring your organization can detect, contain, respond to, and recover from an attack when it happens.
Whether it's a bank, airline, hospital, manufacturer, cloud environment, or cryptocurrency exchange, every major cyber incident reinforces the same message:
Strong cybersecurity isn't built after an attack—it's built before one happens.
Remember: Every cyberattack tells a story. The smartest organizations learn from someone else's incident before it becomes their own.
Comments 0
Email-verified comments are reviewed before they are published.