AU Small Finance Bank probes Salesforce data leak after hacker group's claim
Synopsis
AU Small Finance Bank is investigating a potential breach of a Salesforce-hosted SaaS platform after hacker group ScarlettGroup claimed to have stolen KYC records, Aadhaar and PAN details, loan documents, and more. The bank insists its core systems are untouched — but the incident follows a similar SBI dark-web data exposure earlier this month, raising urgent questions about Indian banking's third-party data security.
Key Takeaways
AU Small Finance Bank confirmed on 30 October 2026 it is probing a potential data leak on a Salesforce -managed SaaS platform.
The compromised platform reportedly holds limited data relating to vehicle loan customers ; the bank's core systems are unaffected.
Hacker group ScarlettGroup claimed to have accessed KYC records, PAN, Aadhaar details, credit reports, loan applications , and more.
Bank shares fell approximately 2% to ₹860.45 on the BSE following the disclosure.
Earlier in October 2026 , State Bank of India (SBI) suffered a breach exposing 3,897 customer records on the dark web.
AU Small Finance Bank on Friday, 30 October 2026, confirmed it is investigating a potential data leak involving a Salesforce-managed software-as-a-service (SaaS) platform, after hacker group ScarlettGroup claimed to have breached the lender's systems and accessed sensitive customer information. The bank said its own core systems remain unaffected and all banking services are operating normally.
What the Bank Said
In an official statement, AU Small Finance Bank said the potentially compromised platform holds only limited data relating to vehicle loan customers and is managed entirely by Salesforce, not by the bank's internal infrastructure. 'AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers,' the bank stated. It added: 'We reaffirm that the bank's own systems remain unaffected and all banking services are operating normally.'
What ScarlettGroup Claimed
According to reports, threat actor ScarlettGroup claimed responsibility for the alleged breach, asserting it had obtained a wide range of customer and internal corporate data. The group reportedly claimed access to KYC records, personal identification documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories, and audit logs. None of these claims have been independently verified, and the bank has not confirmed the scope of any leak.
Market Reaction
Shares of AU Small Finance Bank traded approximately 2% lower at ₹860.45 per share on the BSE on Friday following the development. The stock has recorded a 52-week high of ₹1,144.65 and a 52-week low of ₹832, according to exchange data, suggesting the price had already been under pressure before this incident.
A Pattern of Banking Data Breaches
This incident is not isolated. Earlier in October 2026, state-owned State Bank of India (SBI) experienced a data breach in which 3,897 customer records were reportedly found exposed on the dark web. The SBI had received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding the suspected exposure. The back-to-back incidents involving two prominent Indian lenders point to a broader and growing vulnerability in the financial sector's third-party technology ecosystem.
What Happens Next
AU Small Finance Bank has not disclosed a timeline for completing its investigation or whether it has notified the Reserve Bank of India (RBI) or data protection authorities. Cybersecurity analysts note that SaaS platform breaches are increasingly a blind spot for regulated entities, as customer data stored with third-party vendors may fall outside traditional internal security perimeters. Customers with vehicle loans from the bank are advised to monitor their accounts and report any suspicious activity to the bank's official helpline.
Point of View
PAN cards, and loan agreements, the distinction between the bank's systems and its SaaS provider's systems is largely meaningless to the customer whose data is at risk. The SBI breach earlier this month and now this incident suggest India's banking sector is building a digital Maginot Line: hardening internal infrastructure while leaving third-party data custodians under-scrutinised. Regulators at the RBI and CERT-In have issued alerts but have yet to mandate real-time vendor breach disclosure norms. Until third-party SaaS platforms are treated as extensions of the bank's own risk perimeter, these incidents will keep repeating.
NationPress
30 Oct 2026
Frequently Asked Questions
What happened at AU Small Finance Bank?
AU Small Finance Bank is investigating a potential data leak involving a Salesforce-managed SaaS platform after hacker group ScarlettGroup claimed to have breached the lender's systems on 30 October 2026. The bank says its core banking systems are unaffected, but the third-party platform reportedly holds vehicle loan customer data.
What data did the hackers claim to have stolen?
ScarlettGroup claimed to have obtained KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories, and audit logs. These claims have not been independently verified.
Are AU Small Finance Bank customers at risk?
The bank has stated that only limited data relating to vehicle loan customers on the Salesforce SaaS platform may be involved, and that all banking services are operating normally. Customers with vehicle loans are advised to monitor their accounts and report suspicious activity to the bank.
How did the market react to the data breach news?
AU Small Finance Bank shares fell approximately 2% to ₹860.45 on the BSE on Friday following the disclosure. The stock's 52-week high stands at ₹1,144.65 and its 52-week low at ₹832, per exchange data.
Has this kind of breach happened at other Indian banks recently?
Yes. Earlier in October 2026, State Bank of India (SBI) experienced a data breach in which 3,897 customer records were found exposed on the dark web. SBI had received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In about the suspected data exposure.
