On this page · 5 sections ▾
AU Small Finance Bank said it is investigating a potential data leak on a Salesforce-hosted platform after a hacking group calling itself ScarlettGroup claimed it had stolen customer and internal records. The claim was first flagged on X by the monitoring account H4ckmanac on October 30, 2026. The bank says its own systems are unaffected, and the group's claims have not been independently verified.
Key facts
- Who: ScarlettGroup, an anonymous hacking group, claims responsibility. AU Small Finance Bank is the alleged target.
- Bank's position: The leak may involve a software-as-a-service platform managed and hosted by Salesforce that holds "limited data" on vehicle loan customers.
- Deadline: The group's dark web page shows a countdown labeled "Negotiation deadline" of about six days.
- Unknown: The number of affected customers and the size of the dataset have not been disclosed.
- Verification: Neither India Today nor Mint could independently confirm the claims.
What the group claims
According to India Today, the group says it holds Aadhaar and PAN details, CIBIL scores and other credit reports. Its post also lists bank statements, loan applications, approvals, collateral and insurance records. It further claims staff data, including an employee directory, roles, login history, IP addresses and audit logs.
Mint adds that the group has posted blurred sample documents. India Today notes that the group has not stated a ransom demand, though the countdown suggests it wants a payment.
The bank's response
The bank told India Today Tech that it is investigating a potential leak involving the Salesforce platform. Mint quotes the bank saying its systems "remain unaffected, and all services are operating normally." Mint reads this as meaning the core banking systems were not the issue.
There is a gap between the two accounts. The group describes a broad haul of personal, financial and internal data, while the bank describes limited vehicle loan data on a third-party platform. Until the bank or an independent party discloses what was taken, the real scope stays unclear.
Why it matters
If the claims hold, Aadhaar, PAN and KYC details could feed identity theft and targeted scams, as India Today points out. The incident also shows how data held with a SaaS vendor can become exposure for a bank even when its core systems are untouched.
India Today also notes that State Bank of India confirmed earlier in October a breach that exposed nearly 3,900 customer records.
Gadgets 360 reports, citing HackRisk, that the group threatened to release the data. It separately reports, citing Dark Web Informer, an unrelated listing offering access to Vijay Sales' internal systems for $25,000 (roughly Rs 23,73,600).
