When a hacking group says it has your bank's Aadhaar and PAN files, and the bank answers with a carefully worded sentence about "limited data" on a third-party platform, there's a gap between those two statements. That gap is where customers get nervous, and it's exactly where this story sits right now.
On Friday, 30 October, AU Small Finance Bank said it is investigating a potential data leak tied to a software-as-a-service platform hosted by Salesforce. The platform, according to the bank, holds limited information on its vehicle loan customers. The bank also said its own systems remain unaffected and that services are running normally.
Key takeaways
- The bank has acknowledged an investigation, not a confirmed breach.
- The platform under review is a Salesforce-hosted SaaS tool used for vehicle loans.
- ScarlettGroup has threatened to publish the data; its claims are unverified.
- The bank has not said how many customers could be affected.
- Vehicle loan customers should be careful with calls, links and OTP requests for now.
What exactly has happened?
The story began with a post on social media from a threat-intelligence tracker, Hackmanac, which said a group calling itself ScarlettGroup had breached AU Small Finance Bank. The group claims it took customer and internal corporate data and has threatened to leak it.
The bank responded on 30 October. In its statement it described a potential leak on a Salesforce-managed platform with "limited data" about vehicle loan customers, and repeated that its own systems were not hit. Reports note that the bank hasn't said whether this platform is actually the source of the files the hackers are showing off, or how many people could be involved.
One earlier report pointed out that the bank had initially not acknowledged anything. That changed within a day, which is the kind of quick turnaround you want to see from a regulated lender.
What the hackers claim vs. what the bank says
This is the part most headlines blur together, so here it is side by side.
| Question | Hackers' claim (ScarlettGroup) | Bank's position |
|---|---|---|
| Was there a breach? | Yes, the bank was breached | "Potential data leak" under investigation |
| Where did data come from? | Not clearly specified | A Salesforce-hosted SaaS platform |
| Whose data? | Customers and internal corporate data | Limited data of vehicle loan customers |
| What data? | KYC, ID documents, PAN, Aadhaar, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee data, login histories, audit logs | Not itemised |
| Are core banking systems affected? | Not stated | No, "own systems remain unaffected" |
| Are services running? | Not stated | Yes, operating normally |
| Verified independently? | No | Investigation ongoing |
Why the "Salesforce-hosted" detail matters
Salesforce is a customer-management platform that lenders use to track leads, applications and documents. When a bank says a leak involves a Salesforce-hosted platform, it is pointing at a third-party tool, not the core banking engine where your savings account lives. That distinction is real, and it's why the bank can say its systems are unaffected without necessarily being wrong.
But here's the catch. A loan file doesn't care which server it sits on. If KYC documents, PAN copies and signed agreements were stored there, they are just as useful to a fraudster as if they came from the bank's own database. Customers feel the damage the same way, through phishing, fake loan-recovery calls and identity fraud.
The "whose server was it?" question matters for blame and compliance. For the customer, the only question is what's in the files.
For readers wondering about the wider context: Salesforce-hosted customer data has been a target before. In an earlier campaign, attackers abused tokens from a connected third-party app to pull data out of companies' Salesforce accounts, while Salesforce said its platform itself had not been compromised. Nothing published so far says that's what happened here, and I want to be clear I'm not suggesting it. I'm raising it because it shows how a "not our systems" statement and a real data loss can both be true at once.
A bad fortnight for Indian banking data
This didn't happen in isolation. Barely a week earlier, State Bank of India told the stock exchanges that it had been alerted to a suspected exposure of customer data on the dark web. The alerts, which came on 16 October from its threat-intelligence provider, the Defence Cyber Agency and CERT-In, led SBI to analyse about 375,000 records. It found 3,897 customer records with personal information, including names, dates of birth, mobile numbers, addresses and loan-related metadata. SBI says it has informed the affected customers by email and WhatsApp and brought in a CERT-In-empanelled agency to investigate.
No one has linked the SBI exposure to the AU Small Finance Bank claim, and I'd treat any such link with caution until someone produces evidence. Still, two lenders dealing with data-exposure questions inside two weeks tells you something about how crowded the threat landscape has become, and how much customer data now sits with outside vendors.
What does this mean for AU Small Finance Bank?
The bank is in the middle of a big chapter. It received in-principle approval from the RBI in August 2025 to transition into a universal bank, the first small finance bank to get that nod. Its Q2 FY27 numbers showed net profit up 53% to ₹858 crore, although the stock dropped more than 9% after the results as brokerages gave a mixed outlook.
That share-price fall came days before the leak claim surfaced, so it shouldn't be read as a reaction to it. I haven't seen credible reporting that ties any market move to the data-leak news. What the episode does do is put the bank's third-party risk management in the spotlight at the exact moment it's asking regulators and customers to trust it with a bigger role.
What should customers do right now?
If you have, or ever had, a vehicle loan with AU Small Finance Bank, a few sensible steps cost you nothing:
- Treat unexpected calls as suspect. Fraudsters with loan details sound convincing. They may quote your loan amount, vehicle or EMI date. The bank will never need your OTP, PIN or password.
- Don't click links in SMS or WhatsApp messages claiming to be about loan closure, KYC updates or overdue payments. Open the bank's app or website yourself.
- Check your credit report. You're entitled to a free full credit report once a year from each credit bureau. Look for loans or cards you don't recognise.
- Lock your Aadhaar biometrics through the UIDAI website or the mAadhaar app, which blocks misuse of fingerprint and iris authentication.
- Watch your statements for small, unfamiliar debits. They're often tests before a bigger attempt.
- Report fraud fast. Call the national cyber crime helpline 1930 or file at cybercrime.gov.in, and tell the bank immediately. Speed matters.
My take: the questions I'd want answered
I've followed enough breach stories to know the first statement is rarely the full one. A few things I'd be watching for in the days ahead:
- Scope. "Limited data" is a phrase, not a number. How many customers, and which documents?
- Source. Does the data the hackers are circulating actually match what sat on the Salesforce platform?
- Notification. Will affected customers be told directly, the way SBI did, rather than finding out from a hacker's post?
- The deadline. Reports say ScarlettGroup gave the bank about six days to negotiate before leaking the data. If that's accurate, the window closes around now, so more information, or a dump, could surface soon.
To its credit, the bank spoke up quickly and didn't go silent. But a calm statement about "unaffected" systems only goes so far with someone whose Aadhaar copy may be in a stranger's hands. Customers deserve specifics, and the sooner the better.
Frequently asked questions
Has AU Small Finance Bank confirmed a data breach?
Not a breach as such. The bank says it is investigating a potential data leak involving a Salesforce-hosted SaaS platform that holds limited data on its vehicle loan customers. It says its own banking systems are unaffected and services are running normally.
Who is ScarlettGroup?
ScarlettGroup is the hacking group claiming to have breached AU Small Finance Bank and threatening to leak the data. The claim was first flagged by threat-intelligence monitors and has not been independently verified.
What data do the hackers say they have?
The group claims KYC records, identity documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories and audit logs. These are the attackers' claims, not confirmed findings.
Is my money safe in an AU Small Finance Bank account?
The bank says its core banking systems are unaffected and all services are running normally. The investigation concerns a third-party platform with vehicle loan data. Even so, watch for suspicious calls, messages and unusual transactions.
What should vehicle loan customers do right now?
Never share OTPs or passwords, treat unexpected loan-related calls with suspicion, check your credit report for unfamiliar accounts, lock your Aadhaar biometrics, and report fraud on 1930 or at cybercrime.gov.in.
Is this linked to the SBI data exposure?
No link has been established. SBI separately disclosed a suspected dark web exposure involving 3,897 customer records. The two incidents fall in the same fortnight, but nothing published so far connects them.