AU Small Finance Bank Probes Data Leak Claim

Jaipur-based AU Small Finance Bank said on October 30 that it was investigating a possible data leak involving a Salesforce-hosted platform containing vehicle loan customer information.

The investigation follows a claim by a hacker group called ScarlettGroup that it accessed sensitive customer and internal records. The bank said its own systems remained unaffected and banking services were operating normally.

In a separate incident, a seller using the name “shinymontanna” allegedly offered super-administrator access to electronics retailer Vijay Sales for $25,000, claiming access to more than 3 million order records.

Neither claim establishes that all the information described by the alleged attackers was compromised.

AU Small Finance Bank Investigates Salesforce Data Leak Claim

AU Small Finance Bank confirmed that it was examining a possible leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce.

The platform contains limited information relating to the bank’s vehicle loan customers. The lender has not disclosed how many customers may have been affected.

According to a Moneycontrol report, the bank maintained that its internal systems were unaffected and all banking services continued to operate normally.

AU Small Finance Bank has used Salesforce for vehicle loan onboarding since 2024. The investigation concerns the third-party platform rather than the bank’s core banking infrastructure.

The bank’s shares closed 1.76% lower at Rs 864 on the BSE on October 30.

ScarlettGroup Claims Access to Customer and Internal Records

Cyber threat intelligence account Hackmanac flagged a claim by ScarlettGroup that it had obtained sensitive information linked to AU Small Finance Bank.

The group claimed access to several categories of information, including:

• Know Your Customer (KYC) records, PAN and Aadhaar details
• Credit reports and bank statements
• Loan applications and signed agreements
• Insurance and customer relationship records
• Employee information and login histories
• Internal audit logs

ScarlettGroup operates a leak site on the Tor network. Its reported process involves publicly listing an alleged victim, opening a negotiation period and subsequently releasing data.

Threat trackers recorded the group’s claim involving AU Small Finance Bank’s domain on October 29.

However, the allegations remain unverified. The bank has not released a sample of the allegedly exposed information or confirmed that the claimed records were accessed.

Salesforce customers worldwide have faced voice-phishing attacks during 2026, in which employees were deceived into connecting malicious applications.

The hacking group ShinyHunters was associated with several such attacks. There is currently no evidence connecting that activity to the incident involving AU Small Finance Bank.

Vijay Sales Faces Separate Dark Web Access Claim

Electronics retailer Vijay Sales was also named in an alleged cybersecurity incident during the same week.

A seller identified as “shinymontanna” reportedly listed super-administrator access to the retailer’s systems for $25,000.

Super-administrator access generally provides extensive control over a system, including the ability to view, modify or export information and manage user accounts.

According to a Digit report, the seller claimed access to:

• More than 3 million customer order records
• Information relating to 15,000 employees
• Billing records involving approximately 1.4 lakh vendors

Vijay Sales, a Mumbai-based retailer founded in 1967, had not responded to the allegations in the supplied report.

The claims have not been independently verified, and the reported listing does not establish that the seller possessed the advertised access or information.

SBI Reports Exposure of 3,897 Customer Records

The two allegations followed a separate data exposure disclosure by State Bank of India (SBI).

On October 21, SBI informed stock exchanges that its preliminary examination of approximately 375,000 records found on the dark web had identified 3,897 records containing customer personal information.

According to a New Indian Express report, the bank said the incident had not materially affected its core business operations.

The disclosure came amid wider concerns about the security of customer information held by financial institutions and external technology platforms.

However, the source of SBI’s suspected data exposure had not been established. The three incidents should therefore not be treated as having the same cause.

Data Security and Reporting Requirements in India

The reported incidents raise questions about how organisations manage customer information stored on third-party platforms.

Under India’s cybersecurity reporting requirements, covered cyber incidents must be reported to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of being noticed or brought to an organisation’s attention.

Failure to comply with applicable reporting directions can attract penalties, including a fine of up to Rs 1 lakh.

Listed companies must also disclose cybersecurity incidents to stock exchanges when they meet the applicable materiality requirements.

For customers, the reported claims reinforce the need to remain cautious about unsolicited requests for sensitive information.

Individuals should avoid sharing one-time passwords, PAN details or card information with unknown callers and monitor their bank and loan accounts for unfamiliar activity.

What Customers Should Know

AU Small Finance Bank has confirmed an investigation but has not established the full extent of any potential data exposure.

The Vijay Sales allegations also remain unverified, while SBI has separately disclosed the identification of 3,897 customer records containing personal information.

Customers of the affected organisations should remain alert to suspicious calls, messages and requests for financial information while the relevant investigations continue.

Frequently Asked Questions (FAQs)

1. Has AU Small Finance Bank confirmed a data breach?

No. The bank confirmed that it was investigating a possible data leak involving a Salesforce-hosted platform.

2. What customer information does ScarlettGroup claim to have accessed?

The group claims to have obtained KYC records, PAN and Aadhaar details, loan documents, bank statements and other information. These claims remain unverified.

3. What is the alleged Vijay Sales data breach?

A seller reportedly offered super-administrator access for $25,000 and claimed access to more than 3 million order records.

4. How many SBI customer records contained personal information?

SBI identified 3,897 customer records containing personal information during its preliminary review of approximately 375,000 dark-web records.

5. What should customers do following these data leak reports?

Customers should avoid sharing OTPs, PAN details or card information with unknown callers and monitor their financial accounts for suspicious activity.

---

Disclaimer: We are a media platform sharing stock market and IPO news for informational purposes only. We do not provide investment advice.