AU Small Finance Bank is investigating a potential data leak involving a Salesforce platform. The lender said its own banking systems remain unaffected and services are operating normally. This follows claims from a hacking group that it accessed customer records. The bank is currently looking into the reported security issue.
The lender says its banking systems and services remain unaffected; the investigation follows a hacking group's claim that it accessed KYC, loan and other customer records
AU Small Finance Bank (AU SFB) said it is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to its vehicle loan customers.
"AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers," the lender told Business Standard.
"We reaffirm that the bank's own systems remain unaffected and all banking services are operating normally," the bank further said.
The disclosure follows a claim by a hacking group identified as ScarlettGroup that it breached the bank and accessed sensitive customer information and internal corporate data. According to information published on HackRisk, the group has threatened to leak the data.
The claimed exposure reportedly includes customers' Know Your Customer (KYC) records, Permanent Account Number (PAN) details and Aadhaar details. The group has also allegedly accessed credit reports, bank statements, loan applications and signed agreements. Other data that may have been compromised reportedly includes insurance records, customer relationship management (CRM) data, employee information and internal audit logs.
AU SFB shares tank over 9% post Q2 results; brokerages mixed on outlook
AU Small Finance Bank Q2FY27 result: Net profit jumps 53% to ₹858 crore
Q2 results: IDFC First Bank, Castrol India, JK Cement, 30 more on Oct 24
From SBI to ICICI: Major banking data breaches, cyberattacks in India
SBI probes suspected dark web leak involving 3,897 customer records
The claims have not been independently verified. AU SFB did not say whether the Salesforce-hosted platform it is investigating is the source of the data ScarlettGroup claims to have accessed, or how many customers may be affected.
Last week, the country's largest lender, State Bank of India (SBI), flagged a suspected exposure of customer data on the dark web. A preliminary analysis identified 3,897 customer records containing personally identifiable information, according to a disclosure to the stock exchanges.
The bank received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data on the dark web.
A preliminary analysis of around 375,000 records available on the dark web identified 3,897 customer records containing personal information.
These include registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.
SBI said a detailed investigation is required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank.
The lender activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.