Global Secret Group claims data breach against CO-OP URBAN BANK LTD

• Ransomware group: Global Secret Group
• Country: India
• Sector: Financial Services
• Announcement date: September 10, 2026

Global Secret Group claims data theft from CO-OP URBAN BANK LTD

The threat actor known as Global Secret Group has officially listed CO-OP URBAN BANK LTD on its leak site. According to the group's announcement, the organization has been targeted in a cyberattack resulting in a significant data leak. The group claims to have successfully exfiltrated a substantial volume of data belonging to the institution.

This type of activity is characteristic of modern ransomware operations, particularly those employing double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, these groups aim to pressure victims into paying ransoms to prevent the exposure of confidential information, which can lead to severe regulatory and reputational consequences.

Details of the claimed attack

The announcement regarding CO-OP URBAN BANK LTD was made on September 10, 2026. The threat actor, Global Secret Group, claims that the attack occurred on the same day the listing was posted. The scale of the alleged theft is significant, with the group claiming to have obtained 41.3 GB of data. This dataset is reported to consist of 125,988 individual files.

To support their claims, the attackers have shared several screenshots on their leak site. These images are alleged to be related to the institution's operational data. While these screenshots provide a visual component to the threat, they do not provide a definitive way to verify the full scope or the exact content of the entire stolen dataset. The presence of such screenshots is a common method used by ransomware groups to demonstrate the legitimacy of their breach to both the victim and the public.

Alleged affected data types

Based on the information provided by the threat actor, the stolen data is said to include various types of sensitive information. The specific items mentioned in the claim include:

• Customer records
• Financial documents
• Operational data

While the screenshots shared by the group appear to contain documents related to banking operations, customer records, and financial documents, there is no definitive information currently available regarding the full scope and exact content of the leaked data.

About CO-OP URBAN BANK LTD

The Gudivada Co-op Urban Bank Limited is a cooperative bank operating in the state of Andhra Pradesh, India. It serves as a local financial institution, providing a range of essential services including both retail and commercial banking to its community.

Potential impact and industry implications

The potential consequences of this alleged leak are multifaceted. For the customers of CO-OP URBAN BANK LTD, the exposure of such data may increase the risk of identity theft and fraudulent activities. When financial and personal records are leaked, individuals often become targets for highly targeted phishing attacks, where attackers use stolen information to gain trust and extract further sensitive details or funds.

For the institution itself, the exposure of financial data could lead to significant reputational damage and may trigger potential legal proceedings under the relevant data protection regulations in India. In the financial services sector, maintaining the integrity and confidentiality of customer data is a primary pillar of operational security and regulatory compliance.

In response to such incidents, organizations typically find it necessary to initiate urgent digital forensic investigations. Such investigations are critical to verify the actual content of any leaked data and to determine the exact method of entry used by the threat actor. General defensive measures for organizations in the financial sector often include implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other social engineering vectors.