AU Small Finance Bank Probes Leak Claim on Salesforce Platform
Security / news
AU Small Finance Bank Probes Leak Claim on Salesforce Platform
The bank confirms an investigation into limited vehicle-loan data, while a group claiming Aadhaar, PAN and credit reports has released no samples.
An unnamed extortion group says it holds customer KYC records, PAN and Aadhaar numbers, credit reports and signed loan agreements from AU Small Finance Bank, and the bank confirmed on Oct. 31 that it is investigating a "potential data leak" on a Salesforce-hosted platform. None of the claimed data classes has been verified by anyone outside the group.
The bank's statement, as reported by MediaNama and Inc42, says the platform holds "limited data relating to our vehicle loan customers", that the bank's own systems are unaffected and that "all banking services are operating normally". The bank has not said how many customers are involved or whether the Salesforce platform is where the claimed data came from. The Terminal could not fetch the statement itself, so every quotation here comes from those two outlets.
What the group says it has
MediaNama said the claim first surfaced in a post by Hackmanac, a cybersecurity tracking account on X. The listing was in a "negotiation" state with a countdown of 5 days 17 hours when MediaNama wrote. No samples or full datasets have been released.
Inc42 names the group as ScarlettGroup. MediaNama does not name it, so the attribution rests on one outlet. The claimed data falls into five classes:
- Customer KYC: names, dates of birth, PAN, Aadhaar, contact details, photographs, signatures and screening records
- Credit and financial records: CIBIL and FICO scores, bank statements, loan applications and disbursements
- Signed documents: sanction letters, loan agreements and insurance forms
- CRM records: customer contacts, case notes and stored files
- Staff data: an employee directory, permissions, login history, IP addresses and audit logs
Confirmed, claimed and unknown
| Item | Status |
|---|---|
| A potential leak is under investigation | Confirmed by the bank |
| Vehicle loan customer data sits on a Salesforce platform | Confirmed by the bank, called "limited" |
| Aadhaar, PAN, credit reports and loan agreements | Claimed, unverified |
| Employee records and audit logs | Claimed, unverified |
| Bank systems unaffected | Bank's statement only |
The bank's wording leaves one question open that matters for customers. A leak confined to vehicle loan files would still hold KYC data, because a loan application collects it. The group's list is broader, and the bank has addressed neither the employee data nor the wider scope.
Salesforce, and what is not established
AU Small Finance Bank partnered with Salesforce in 2024 to digitise vehicle loan onboarding, according to Inc42. Salesforce customers have previously been hit by social engineering and malicious third-party app campaigns, Inc42 said, but it found no verified evidence linking this case to those campaigns or showing that Salesforce's core platform was compromised.
That distinction matters for severity. A misconfigured or phished customer tenant is a problem for the bank's controls. A flaw in the platform would be a problem for every customer of the vendor. Nothing published so far supports the second reading.
The same group's other claims
MediaNama reported that the group also claims Rajasthan Police data. The claimed figures are large and specific, which is what a seller lists to prove possession. They are claims, not findings.
- Identity records73K items
- Records69K items
- Attachments23K items
- Mailboxes5926 items
Source: MediaNama, accessed 2026-10-31
The group also claims 21 VPN logins with cleartext passwords and 64 VPN client certificates. MediaNama has emailed Rajasthan Police for comment and has not confirmed any of it.
A second, separate claim ran the same day. Inc42 reported that an actor using the handle shinymontanna offered super administrator access to Vijay Sales' internal systems for $25,000, covering more than 3 million order records and information on 15,000 employees. Screenshots have circulated and Vijay Sales did not respond to Inc42.
The Terminal reported earlier on how Indian regulators handled NBFC cyberattack disclosures. It also covered a worm spreading through npm test accounts, a different kind of exposure.
Customers of the bank should expect the countdown to run out around Nov. 6 if it was accurate when MediaNama wrote. The bank has not said when it will report its findings.
Sources
More in Security
- 01Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 02Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 03KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.
- 04Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and UbuntuThe kernel team scores the use-after-free 9.8, Anthropic says its model wrote a root exploit for it, and the two biggest enterprise distributions have no fixed kernel.