AU Small Finance Bank investigates a possible leak of vehicle loan data from a Salesforce hosted platform after a hacker group's claims

AU Small Finance Bank said on October 30 that it is investigating a potential data leak involving a software as a service platform managed and hosted by Salesforce, which holds limited data relating to its vehicle loan customers. "We reaffirm that the Bank's own systems remain unaffected and all banking services are operating normally," a spokesperson said in statements carried by Reuters, Moneycontrol and ThePrint. The bank did not say how many customers may be affected or whether it has contacted them, Moneycontrol and ThePrint reported.

The probe followed claims by a hacker group calling itself ScarlettGroup that it had breached the lender and would publish customer and internal data. The claims were flagged on X on October 29 by the threat monitoring accounts H4ckmanac and HackRisk.io, according to Moneycontrol, ThePrint and The Times of India. The group says the data includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements, insurance records, CRM data, employee information, login histories and audit logs. ThePrint and India Today said they could not independently verify the claims. India Today reported that the group's dark web post carried a negotiation deadline countdown that had dropped below six days on October 30.

A person with knowledge of the matter told BusinessLine that the issue was being examined across all verticals, though only the Wheels vertical may have had potential breaches, and that claims of KYC data exposure were unverified. ThePrint reported that AU tied up with Salesforce in March 2024 to digitise onboarding of vehicle loan customers. Vehicle loans are the bank's oldest business: AU began in 1996 as a vehicle finance company and became a small finance bank in 2017, and its vehicle loan book crossed Rs 50,000 crore in assets this year, serving over 13.7 lakh customers and making up nearly a third of its loans, ThePrint reported. The bank had 12.2 million unique customers at the end of FY26, according to its annual report cited by Moneycontrol.

AU's shares fell about 1.7% to Rs 865.7 on October 30, Reuters and Moneycontrol reported. The incident comes as the Reserve Bank of India pushes lenders to strengthen cybersecurity, and a week after State Bank of India reported a cyberattack in which 3,897 customer records containing personally identifiable information were leaked on the dark web, Reuters reported. ThePrint noted that Salesforce customers have faced several extortion campaigns since 2025, some using voice phishing to get staff to connect rogue apps, but said there is no evidence so far linking the AU claim to those campaigns.