AU Small Finance Bank probes a vehicle-loan data leak claim
AU Small Finance Bank is investigating a possible leak from a Salesforce-hosted platform after a hacker group's claim. Its own systems are unaffected.
AU Small Finance Bank said on Friday, 30 October 2026, that it is investigating a possible data leak linked to a Salesforce-hosted software platform that holds limited information on its vehicle loan customers. The probe follows a claim by a hacker group. The bank says its own systems are unaffected, and no one has yet confirmed what data, if any, was taken. The details come from ThePrint, The Tribune and Inc42.
What the bank has said and what has been claimed
The bank told reporters it is looking into a potential leak involving a SaaS (software-as-a-service) platform that Salesforce runs and hosts. It added that all banking services are working as usual. It did not say whether that platform is the source of the data the group claims to hold, or how many customers may be affected.
The claim surfaced on 29 October, when the cybersecurity tracker Hackmanac flagged a post by a group calling itself ScarlettGroup. According to ThePrint, the group says it holds KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs, and it has threatened to publish them. Inc42 and ThePrint both say they could not verify these claims. Tribune reports that AU was listed on a leak site tied to the group and that the data allegedly accessed has not been independently verified. ThePrint reports AU shares fell 1.9% to Rs 864 on Friday.
Why a vendor platform matters
In March 2024, AU partnered with Salesforce to digitise onboarding for vehicle loans. Think of it as keeping part of your paperwork in a rented locker: the locker is run by someone else, but you still answer for what is inside. ThePrint says the bank's vehicle loan book is above Rs 50,000 crore, serves over 13.7 lakh customers and is nearly a third of its loans, so even a "limited" dataset could touch many people. Salesforce customers have faced voice-phishing campaigns since 2025, but ThePrint says there is no evidence linking AU to those.
ThePrint reports that AU's shares fell 1.9% to Rs 864 on Friday. Working back from that, the previous close was about Rs 881. The chart shows the two prices side by side.
Not an isolated case
ThePrint says ScarlettGroup runs a leak site on Tor, lists victims, offers a window to negotiate and threatens publication if talks fail, and has claimed attacks on Rajasthan Police and Genesys Cloud Services. Other recent incidents involve lenders and retailers. SBI found 3,897 customer records among about 3.75 lakh it checked on the dark web, and Bank of Baroda disclosed unauthorised access through an employee's email in July. Inc42 also reports a separate, unverified listing offering Vijay Sales administrator access for $25,000.
What it means for readers
For AU's borrowers, the practical risk, if data was taken, is phishing and identity misuse, since PAN, Aadhaar and loan details help scammers sound convincing. Treat calls or messages that quote your loan details with care, and verify them with the bank through its official channels. For lenders, the lesson is that vendor-hosted platforms sit inside the risk perimeter. Neither article discusses what the bank must report to the RBI or CERT-In, so we make no claim on that. What is confirmed is the bank's probe; the scale and the data are unknown.
Use the calculator to see how an exposure of a given size would translate into numbers. The share of customers affected and the notification cost are examples, not findings.
What to watch next
Watch for the bank's own update on whether the Salesforce platform was the source and how many customers are involved, and for whether the group publishes any data. Any statement to the exchanges or a regulator notice would also change the picture.
Key takeaways
- AU Small Finance Bank confirmed on 30 October 2026 that it is probing a possible leak from a Salesforce-hosted platform holding limited vehicle-loan data.
- The hacker group's list of stolen data is unverified, and the number of affected customers is unknown.
- The bank says its own systems are unaffected and services are normal.
- The case adds to a run of data incidents at Indian lenders this year.
Sources
- [ThePrint: AU Small Finance Bank probes potential data leak from SaaS platform after hacker group claims breach](https://theprint.in/tech/au-small-finance-bank-probes-potential-data-leak-from-saas-platform-after-hacker-group-claims-breach/3086172/)
- [The Tribune: AU Small Finance Bank probes possible data breach on Salesforce platform](https://www.tribuneindia.com/news/business/au-small-finance-bank-probes-possible-data-breach-on-salesforce-platform/)
- [Inc42: AU SFB probes potential data leak, Vijay Sales admin access allegedly listed for $25K](https://inc42.com/buzz/au-sfb-probes-potential-data-leak-vijay-sales-admin-access-allegedly-listed-for-25k/)
Tags: AU Small Finance Bank Cybersecurity Data privacy Vehicle loans Salesforce