Key Highlights

  • Probe under way: AU Small Finance Bank is investigating a potential data leak on a software-as-a-service (SaaS) platform managed and hosted by Salesforce.
  • Limited scope, says bank: The platform holds limited data on vehicle loan customers. The bank says its own systems are unaffected and all services are running normally.
  • Hacker claim: A group called ScarlettGroup has reportedly claimed to have accessed KYC records, PAN and Aadhaar details, credit reports and internal data. These claims have not been independently verified.
  • Share price hit: AU Small Finance Bank shares traded about 2% lower at Rs 860.45 on the BSE.
  • Not an isolated case: Earlier in October, 3,897 SBI customer records were found exposed on the dark web.

New Delhi: Jaipur-headquartered AU Small Finance Bank on Friday confirmed it is investigating a potential data leak. The probe follows a hacker group's claim that it breached the lender and accessed sensitive customer information. The bank said the issue relates to a third-party platform, not its core banking systems.

"AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers," the bank said in a statement.

"We reaffirm that the bank's own systems remain unaffected and all banking services are operating normally," it added. In March 2024, the bank had partnered with Salesforce to introduce a digital customer onboarding solution for its vehicle loan customers.

What the Hackers Claim and What Remains Unverified

According to reports, the hacking group ScarlettGroup claimed responsibility for the alleged breach. The group claimed it obtained customer and internal corporate data, including KYC records, personal identification documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories and audit logs.

There is a clear gap between the hackers' claims and the bank's account. The bank describes the affected data as "limited" and confined to vehicle loan customers on one external platform. The full scope of any exposure will only be known once the investigation is complete. Until then, the hacker group's list should be treated as a claim, not a confirmed fact.

The market reacted cautiously. AU Small Finance Bank shares traded about 2 per cent lower at Rs 860.45 apiece on the BSE. The stock's 52-week high is Rs 1,144.65 and its 52-week low is Rs 832.

A Wider Warning for Banks Using Cloud Platforms

The case shows a growing weak spot for Indian lenders: third-party cloud and SaaS tools that hold customer data outside a bank's own systems. Globally, extortion groups have targeted companies through a wave of Salesforce-related breaches, often by going after how individual organisations configure and connect to the platform. Even when a bank's core systems are secure, data held by vendors can become the entry point.

It is also the second banking data incident in India this month. Earlier in October, State Bank of India (SBI) found 3,897 customer records exposed on the dark web, after alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In.

For AU Small Finance Bank's vehicle loan customers, the immediate risk is less about money being taken from accounts and more about misuse of personal details. Leaked KYC or loan data is often used for targeted phishing, fake recovery calls and impersonation frauds. Customers should be careful with unexpected calls or messages that quote their loan details. They should never share OTPs, PINs or passwords, and should contact the bank only through its official channels.

With inputs from IANS