Five recent Indian data breaches expose weaknesses in digital security and banking systems

In October 2026 a security flaw was identified in eight intermediate certificates issued by Bengaluru-based eMudhra Ltd., where weak private keys could be reconstructed, leading Google, Mozilla, Apple and Microsoft to revoke the certificates. The State Bank of India disclosed that 3,897 of its customers' personal details were found in a dark-web cache of roughly 3.75 lakh records, though the bank said core operations were unaffected.

Bank of Baroda later confirmed that a compromised employee email account gave attackers access to a dataset advertised as more than 700 GB of customer and internal audit information, but its core banking platform remained secure. Reliance Group acknowledged a partial breach of a server hosted by Yotta after a ransomware group posted documents it said were tied to the Kudankulam Nuclear Power Plant, highlighting risks to critical-infrastructure data. Finally, Vitraya Technologies, which runs a digital health-insurance platform, petitioned the Supreme Court for a CBI probe after a coordinated attack in February 2025 that extracted large volumes of personal, medical and Aadhaar-linked data.