The AU Small Finance Bank data leak is an ongoing investigation, not a confirmed breach. The Jaipur-headquartered lender said on Friday, October 30, 2026, that it is investigating a potential leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data about its vehicle loan customers. The bank says its own systems are unaffected and that all banking services are running normally.
The probe follows a claim by a hacker group calling itself ScarlettGroup. The group says it holds customer and internal data and has threatened to publish it. None of those claims has been independently verified.
How we reported this: This article is based on the bank’s statement as reported by ThePrint and other outlets, reporting by Inc42, ANI and Business Standard, and on posts by cyber-threat monitoring accounts. We have not seen any allegedly leaked data, and we do not link to or host it. Our own interpretation appears in the section marked “Our analysis.”
AU Small Finance Bank Data Leak: 8 Key Facts
- Bank statement: AU is investigating a potential data leak on a Salesforce-hosted SaaS platform holding limited vehicle loan customer data.
- Own systems: The bank says its core systems are unaffected and services are normal.
- The claim: ScarlettGroup says it breached the bank and threatens to publish data.
- Listing date: AU was listed on a leak site linked to the group on October 29. tribuneindia
- Claimed data: KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs.
- Verification: Unverified. A person familiar with the matter called the KYC claims “unverified and unvalidated.”
- Scope of the probe: Examined across all verticals, though only the Wheels (vehicle loan) vertical may have had a potential breach, per that source.
- Not disclosed: Whether the Salesforce platform is the source of the claimed data and how many customers may be affected.
What AU Small Finance Bank Said
In a statement to ThePrint and other outlets, the bank said it is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce that holds limited data relating to its vehicle loan customers. It reaffirmed that its own systems remain unaffected and that all banking services are operating normally.
The bank did not say whether the Salesforce-hosted platform is the source of the data the group claims to hold, or how many customers may be affected. business-standard
Here is the post that flagged the claim:
What the Hacker Group Claims
The group, which calls itself ScarlettGroup, says the data it holds includes:
| Category | Claimed contents |
|---|---|
| Customer identity | KYC records, PAN and Aadhaar details |
| Financial | Credit reports, bank statements, loan applications and signed agreements |
| Other customer records | Insurance records and CRM data |
| Internal | Employee information and audit logs |
ThePrint said it could not verify the claims. The first alerts came from threat-monitoring accounts; reports differ on which account first posted, naming either Hackrisk or @H4ckmanac.
The Salesforce Link
In March 2024, AU tied up with Salesforce to digitise onboarding for its vehicle loan customers. Its retail assets head said then that Salesforce was a partner in digitising customer journeys for vehicle loans.
Vehicle loans are the bank’s oldest business. AU began in 1996 as a vehicle finance company and became a small finance bank in 2017. According to ThePrint, its vehicle loan book crossed ₹50,000 crore in assets under management this year, serves over 13.7 lakh customers and makes up nearly a third of its loans.
Salesforce customers have faced multiple attacks since 2025. In one campaign reported earlier, hackers used voice phishing to trick staff into linking rogue apps to company Salesforce accounts and then extorted the firms. Salesforce said there was no sign its own platform had been compromised and refused to pay the hackers. There is no evidence so far linking the AU claim to those campaigns.
A Month of Leak Claims
| Date | Development |
|---|---|
| October 16 | SBI received alerts from its threat-intelligence provider, the Defence Cyber Agency and CERT-In about suspected customer-data exposure. A check of around 3.75 lakh records found 3,897 SBI customer records with personal information. |
| October (earlier this month) | ScarlettGroup claimed a breach of Rajasthan Police data on a hacking forum. The state launched a probe, and personnel were told to change email passwords. |
| October 21 | The group also claimed an attack on US firm Genesys Cloud Services. |
| October 29 | AU Small Finance Bank listed on the group’s leak site. |
| October 30 | AU issues its statement. Separately, an actor claimed to be selling administrator access to retailer Vijay Sales’ systems for $25,000, which the company has not confirmed. |
Our Analysis: What the AU Small Finance Bank Data Leak Really Says
This section is our own analysis and opinion, based on the reports above. The calculations are simple arithmetic. It is not legal, security or financial advice.
1. The bank’s statement is careful, and it is worth reading closely
The statement says three things: it is investigating a potential leak, the platform is Salesforce-hosted and holds limited data on vehicle loan customers, and the bank’s own systems are unaffected. It does not say the claim is false, it does not say the platform is or isn’t the source of the claimed data and it gives no number. That wording is typical early in an incident. It tells us the bank takes the claim seriously enough to name a specific platform, which we would not expect for a baseless claim, but it doesn’t confirm that any data was taken.
2. “Our systems are unaffected” may be true and still not reassure customers
If customer data sat on a vendor-hosted platform, customers don’t care whose servers it was on. As we understand India’s data-protection framework, the organisation that decides how personal data is used remains responsible even when a vendor handles it. The framework is being phased in, so check the current rules before quoting this point. The practical lesson: a bank can run a secure core system and still be exposed through the tools around it.
3. The claimed data is the kind that makes fraud easy
PAN, Aadhaar details, bank statements, credit reports and signed loan agreements are the ingredients for impersonation, fraudulent loan applications and convincing scam calls. If real, this is more worrying than a leaked email list. We stress “if”: none of it is verified.
4. Headline record counts in leak claims can be misleading, and SBI is a useful comparison
In the SBI case, the claim covered about 3.75 lakh records, and an official check found 3,897 customer records with personal information. That is about 1% of the claimed rows (our calculation). It suggests hackers’ totals can include duplicates, non-sensitive rows or recycled data. But 3,897 people is still a real harm, so the lesson is to treat big numbers cautiously and small confirmed numbers seriously. We don’t know how AU’s case will compare.
5. The scale is unknown, but the bank’s own numbers set the outer limit
AU says it serves over 13.7 lakh vehicle loan customers. The bank describes the data on the platform as “limited,” and nobody has said how many people are involved. The customer base is the ceiling for a vehicle-loan-only exposure, not an estimate of the damage.
6. Third-party SaaS has become a favourite target
Reports of Salesforce-related attacks since 2025 describe tricking staff, not breaking the platform, and Salesforce says its own platform wasn’t compromised. That suggests the weak spot is often how a company’s accounts and connected apps are managed, not the software itself. This is our interpretation of those reports, and again there is no evidence linking them to AU.
7. The leak-site model is built around pressure
The group reportedly lists victims, offers a window to negotiate and threatens to publish data if talks fail. A public countdown pushes a company to decide quickly, and it also pushes news outlets to publish before facts are checked. That’s one reason we are careful with wording here.
8. A pattern is emerging, and KYC is the common thread
SBI in mid-October, AU at the end of the month, a police force, a US cloud firm and a retailer’s admin-access listing all appeared within weeks. Different victims and different groups, but the pitch is similar: identity documents and financial records. We wouldn’t call it a single campaign, since the reports don’t say so.
9. The security-industry response is “protect data beyond the breach”
PrivaSapien’s CEO Abhilash Soundararajan said the whole cybersecurity approach needs rethinking, with data protected even after a breach through stronger cryptographic and statistical methods. We agree with the direction in plain terms: collect less, keep it for less time and make stolen data useless. That is general principle, not a claim about what AU did or didn’t do.
10. What we would watch
We’d watch whether the bank gives numbers and a timeline, whether CERT-In or the RBI say anything, whether the group publishes data and whether Salesforce comments. We’d also watch whether other lenders using the same kind of platform report anything.
What AU Vehicle Loan Customers Can Do Now
General guidance, not security or legal advice. You don’t need to wait for confirmation to protect yourself.
- Never share OTPs, PINs or passwords, even with someone claiming to be from AU Bank.
- Be wary of calls, SMS and emails about loans, KYC updates or “verification,” especially if they quote your loan details. Scammers will use real-sounding information.
- Don’t click links in messages. Go to the bank’s official website or app yourself.
- Check your credit report for loans or enquiries you didn’t make. In India, you can request a free full credit report once a year from each credit bureau.
- Watch your statements and turn on transaction alerts.
- Consider locking your Aadhaar biometrics through the official UIDAI options.
- Report fraud quickly to the bank and to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the helpline 1930.
- Use only the bank’s official channels for updates, and ignore forwarded “leak lists.”
- Don’t download or search for leaked files. They are often bait for malware.
What We Still Don’t Know
- Whether any customer data was actually taken
- Whether the Salesforce platform is the source of the claimed data
- How many customers may be affected
- What kinds of data the platform holds
- When the incident occurred, or whether it is ongoing
- Whether the bank has informed regulators and customers
- Whether the group will publish data
What to Watch Next
- An update from AU Small Finance Bank, including customer communication
- Statements from Salesforce, CERT-In or the RBI
- Whether data is published and independently checked
- Further listings by the same group
- Moves by other banks to review vendor platforms
Frequently Asked Questions About the AU Small Finance Bank Data Leak
Has AU Small Finance Bank confirmed a data breach?
No. It said it is investigating a potential data leak involving a Salesforce-hosted platform that holds limited data on its vehicle loan customers.
Are AU’s core banking systems affected?
The bank says its own systems are unaffected and banking services are operating normally.
Who is claiming the breach?
A hacker group calling itself ScarlettGroup. Its claims have not been independently verified.
What data does the group claim to have?
KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs. None of this has been verified.
How many customers are affected?
Unknown. The bank has not given a number.
Is Salesforce responsible?
Not established. Salesforce said earlier, in relation to attacks on its customers, that it saw no sign its own platform had been compromised. No report links that to the AU claim.
What should I do if I have an AU vehicle loan?
Be careful with unexpected calls and messages, never share OTPs, monitor your accounts and credit report and report any fraud to the bank and to cybercrime.gov.in or 1930.
Is this related to the SBI data leak report?
Both emerged within weeks, but reports don’t link them.
Disclaimer
This article reports claims made by a third-party hacker group and by threat-monitoring accounts, together with a statement from AU Small Finance Bank. The claims have not been independently verified. The article does not state or imply that any customer data has been confirmed leaked. References to the types of data involved are conditional and based on media reports. This site does not host, share or link to any allegedly leaked data. Derived figures (such as the SBI percentage) are our own approximate calculations. The “Our analysis” and customer-guidance sections are opinion and general information, not legal, security or financial advice. Rely on the bank’s official communications and the authorities for confirmed information. The article will be updated if new verified information becomes available. This site is not affiliated with AU Small Finance Bank, Salesforce or any group named.
To read more cybersecurity coverage, see our posts on the Martech and AI and how to avoid online banking fraud. You can also read the original reporting on ThePrint and Inc42, and visit the National Cyber Crime Reporting Portal.
