New Delhi: After a hacker group claimed to have breached AU Small Finance Bank’s records and threatened to release customer data, the Jaipur-headquartered lender Friday said it is probing the potential data leak from software-as-a-service (SaaS) platform.
“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers,” a spokesperson said in response to ThePrint’s queries.
“We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.”
The bank did not say if the Salesforce platform is the source of the data the group claims to hold, or the records of how many customers may have been compromised.
The threat
The claims surfaced Thursday after the X account @H4ckmanac, which tracks cyberattacks, flagged the group’s post and its threat to publish the data.
The group calls itself “ScarlettGroup”, and has claimed that the “compromised” data includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements, as well as insurance records, CRM data, employee information and audit logs. ThePrint could not independently verify the claims.
Shares of AU SFB fell 1.9 percent to Rs 864 Friday.
🚨Cyber Alert ‼️
🇮🇳India – 𝗔𝗨 𝗦𝗺𝗮𝗹𝗹 𝗙𝗶𝗻𝗮𝗻𝗰𝗲 𝗕𝗮𝗻𝗸
The ScarlettGroup hacking group claims to have breached AU Small Finance Bank and threatened to leak sensitive customer and internal corporate data. According to the attackers, the compromised information… pic.twitter.com/8V8lV1x4CT
— Hackmanac (@H4ckmanac) October 29, 2026
The Salesforce link
In March 2024, the bank had tied up with Salesforce to digitise onboarding of its vehicle loan customers.
Bhaskar Karkera, head of retail assets at AU SFB, had then described Salesforce as the bank’s partner “in digitising customers’ journeys for vehicle loans”.
Vehicle loans are the bank’s oldest business. AU began in 1996 as a vehicle finance company, and later turned into a small finance bank in 2017.
Its vehicle loan book crossed Rs 50,000 crore in assets under management this year, serving over 13.7 lakh customers and accounting for nearly a third of its loans.
Salesforce customers have faced multiple attacks since 2025. In one such instance, hackers used voice phishing to trick staff into linking rogue apps to company Salesforce accounts, and then extorted the firms.
Salesforce said there was no sign its own platform had been compromised, and refused to pay the hackers.
There is no evidence so far linking the AU SFB claim to those campaigns.
Who is ‘ScarlettGroup’
Cybersecurity firm Foresiet, in a 21 October report, said that the group runs a leak site on the Tor network, lists victims, offers a window to negotiate and threatens to publish data if talks fail.
The group has made claims against other entities as well this month.
Announcing a breach of Rajasthan Police on BreachForums, it wrote: “We have breached Rajasthan Police, and its data is now available for purchase.” Rajasthan Police launched a probe, with Cyber Crime DIG Shantanu Kumar saying that the state had received information that the group had obtained data from several government departments. Personnel were told to change email passwords.
On 21 October, the group also claimed an attack on US firm Genesys Cloud Services.
A month of leaks
The AU SFB claim comes a week after State Bank of India (SBI) flagged a suspected exposure of customer data on the dark web. SBI got alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and CERT-In. A check of around 3.75 lakh records found 3,897 SBI customer records with personal information.
On Friday, a separate actor claimed to be selling administrator access to retailer Vijay Sales’ systems for $25,000. The company has not confirmed a breach yet.
Also Read: What’s the eMudhra security scare that has rattled the internet? All you need to know