AU Small Finance Bank Data Leak: What’s Confirmed So Far

AU Small Finance Bank is investigating a potential data leak after a group calling itself ScarlettGroup claimed on 29 October 2026 to hold customer KYC and loan records. The bank says the exposure involves a SaaS platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers, and that its own systems are unaffected. The bank has not confirmed that data was taken, how many people are involved, or that the group’s data came from that platform.

What AU Small Finance Bank said

The Jaipur-headquartered lender gave the same statement to ThePrint and, “in an official response”, to ANI on 30 October 2026:

“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers. We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.”

ThePrint reports the bank “did not say if the Salesforce platform is the source of the data the group claims to hold, or the records of how many customers may have been compromised.” The platform is not a surprise: ThePrint notes the bank tied up with Salesforce in March 2024 to digitise onboarding of its vehicle loan customers. Vehicle finance is AU’s oldest business; the company began as a vehicle financier in 1996 and became a small finance bank in 2017.

What ScarlettGroup claims

The claim surfaced on Thursday 29 October, when the X account @H4ckmanac, which tracks cyberattacks, flagged the group’s post and its threat to publish the data (per ThePrint). Ransomware.live lists au.bank.in on ScarlettGroup’s page with a discovery date of 29 October 2026. ANI reports the group claimed KYC documents, PAN and Aadhaar details, bank statements, credit reports, loan applications and agreements, and internal information such as employee records, CRM data, login histories and audit logs. ThePrint and ANI both say they could not independently verify the claims.

Ransomware.live describes ScarlettGroup as a new group (first victim estimated 5 October 2026, nine claimed victims by 1 November) and adds that claims from emerging groups “should be treated with caution until independently verified.” A leak-site listing is a claim, not proof of a breach.

Timeline

Why the Salesforce detail matters

A bank can keep its core banking system locked down and still lose customer data from a SaaS platform it uses for onboarding or loan servicing. In the 2025 wave of Salesforce data thefts, attackers did not break Salesforce itself: they phished staff into authorising a malicious connected app, or stole OAuth tokens from a third-party integration, and then exported records the customer’s own account could reach. We track those incidents in the Salesforce Breach Index entry. AU SFB has not said how access happened here, so treat that history as context for your own review, not as an explanation of this case.

The bank’s line that “the Bank’s own systems remain unaffected” is precise and worth reading carefully: a SaaS tenant holding KYC and loan documents is outside “own systems” but very much inside the bank’s data. For regulators and customers, the data is what counts.

Part of a pattern in Indian banking

The claim lands days after State Bank of India said, in a stock-exchange filing, that it had received alerts on 16 October from its threat-intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure, and on 21 October that a preliminary review of about 3.75 lakh records found 3,897 SBI customer records with personal information (per ANI and ThePrint). The two incidents are separate; there is no reported link between them. Indian entities must report qualifying cyber incidents to CERT-In within six hours of noticing them under CERT-In’s April 2022 directions. Neither outlet reports whether AU SFB has notified CERT-In or the RBI.

What security leaders should do this week

• List every SaaS tenant that holds KYC, identity or loan documents (CRM, onboarding, collections, document management) and who owns each one. Score them with the SaaS Security Assessment.
• Audit connected apps and OAuth grants in Salesforce and similar platforms. Remove anything unused, restrict who can authorise new apps, and alert on new grants. Practise spotting a malicious consent request in the OAuth Consent Lab.
• Turn on and export SaaS event logs (logins, API calls, report and bulk exports) to your SIEM so you can answer “what was taken” within hours, not weeks.
• Minimise what sits in SaaS. Store masked Aadhaar numbers, and keep full KYC images in a controlled vault with short retention.
• Pre-write the third-party breach playbook: who calls the vendor, what logs you need from them, and when the CERT-In six-hour clock starts. Use the Third-Party Breach Response Checklist and the Breach Notification Clock Calculator.
• Prepare customer comms for scam calls. Leaked loan details make vishing far more convincing; tell customers now what you will never ask for.

What AU Bank customers can do now

• Do not share an OTP, PIN, CVV or UPI PIN with anyone, even a caller who knows your loan number.
• Call the bank back on the number on its official website or your statement, never a number given in a message.
• Check your credit report for loans or enquiries you do not recognise.
• Lock your Aadhaar biometrics in the mAadhaar app or on the UIDAI website.

Frequently asked questions

Was AU Small Finance Bank hacked?

Not confirmed. On 30 October 2026 the bank said it is investigating a potential data leak involving a software-as-a-service platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers, and that its own systems are unaffected. A group calling itself ScarlettGroup claims to hold customer and internal data; the bank has not confirmed that any data was taken.

What data does ScarlettGroup claim to have from AU Small Finance Bank?

According to ThePrint and ANI, the group claims KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements, plus insurance records, CRM data, employee information, login histories and audit logs. Neither outlet could verify the claims, and the bank has not confirmed any of these categories.

How many AU Small Finance Bank customers are affected?

Nobody knows yet. The bank has not given a number and has not said whether the data the group claims came from the Salesforce-hosted platform. ThePrint notes the bank’s vehicle loan business serves over 13.7 lakh customers, but that is the size of the business, not a count of affected people.

Was Salesforce breached?

There is no statement that Salesforce’s own platform was breached. The bank described the system as a SaaS platform managed and hosted by Salesforce. In past Salesforce-related incidents, data was taken by abusing a customer’s access (stolen credentials, phished staff or compromised connected-app tokens) rather than through a flaw in Salesforce itself. How access happened here has not been disclosed.

I have an AU Bank vehicle loan. What should I do?

Assume your PAN, Aadhaar and loan details could be used to make scam calls and messages more convincing. Do not share an OTP, PIN or card details with anyone who calls about your loan, call the bank back on the number printed on its official website or your statement, check your credit report for loans you did not take, and lock your Aadhaar biometrics in the mAadhaar app or on the UIDAI website.

Who is ScarlettGroup?

A new extortion group. Ransomware.live first recorded it in October 2026, lists nine claimed victims by 1 November, and says claims from emerging groups should be treated with caution until independently verified. ThePrint reports it also claimed Rajasthan Police and Genesys, with no evidence so far linking those campaigns to the AU claim.

Sources

• ThePrint, “AU Small Finance Bank probes potential data leak from SaaS platform after hacker group claims breach”, 30 Oct 2026
• ANI via The Tribune, “AU Small Finance Bank probes potential customer data leak, says banking systems unaffected”, 30 Oct 2026
• Business Standard, “AU Small Finance Bank probes potential data leak on Salesforce platform”, 30 Oct 2026
• Hackmanac on X, 29 Oct 2026
• Ransomware.live, ScarlettGroup group page
• CERT-In directions under section 70B(6) of the IT Act, 28 Apr 2022

PlayCISO is independent and not affiliated with AU Small Finance Bank, Salesforce or any organisation named here. This page will be updated as the bank shares more.