AU Small Finance Bank probes potential data leak on Salesforce platform
Mumbai, Oct 30, 2026
The lender says its banking systems and services remain unaffected; the investigation follows a hacking group's claim that it accessed KYC, loan and other customer records
AU Small Finance Bank (AU SFB) said it is probing a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data of its vehicle loan customers.
“We reaffirm that the bank’s own systems remain unaffected and all banking services are operating normally,” it further said.
The disclosure follows a claim by a hacking group identified as ScarlettGroup that it breached the bank and accessed sensitive customer information and internal corporate data.
According to information published on HackRisk, the group has threatened to leak the data. The claimed exposure reportedly includes customers' know-your-customer (KYC) records, permanent account number (PAN) and Aadhaar details.
The group has also allegedly accessed credit reports, bank statements, loan applications and signed agreements. Other data that may have been compromised reportedly includes insurance records, customer relationship management (CRM) data, employee information and internal audit logs.
The claims have not been independently verified. AU SFB did not say whether the Salesforce-hosted platform it is investigating is the source of the data ScarlettGroup claims to have accessed. Or, how many customers may be affected.
The incident comes at a time when Anthropic's Mythos, unveiled earlier this year, found major vulnerabilities across every major operating systems and web browsers during its preview. CERT-In has issued several advisories and clarifications since then.
Experts believe frontier artificial intelligence (AI) models can find software flaws faster, write exploits and run multi-stage cyberattacks with minimal human intervention.
An industry source said that while companies are trying to report incidents within six hours, they are still relying on existing cyber defences. This is at a time when new vulnerabilities are being found and exploited almost in real time.
Last week, the country’s largest lender, State Bank of India (SBI), flagged a suspected exposure of customer data on the dark web.
A preliminary analysis identified 3,897 customer records containing personally identifiable information, according to a disclosure to the stock exchanges.
The bank received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In), regarding the suspected exposure of customer data on the dark web.
A preliminary analysis of around 375,000 records available on the dark web identified 3,897 customer records containing personal information.
These include registered mobile numbers, date of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF), lead IDs, and metadata associated with loan and lead records.
SBI said a detailed investigation is required to establish the authenticity and completeness of the exposed data. It would determine the potential source and extent of the exposure, and assess the risks to customers and the bank.
The lender activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.
[The Business Standard]
