AU Small Finance Bank is investigating a potential customer data leak after a hacking group called ScarlettGroup claimed to have breached the lender and stolen sensitive information, including customer PAN and Aadhaar details. The allegations surfaced on October 29, 2026, after cybersecurity monitoring accounts flagged the group’s claims and its threat to publish the allegedly stolen information.
The bank has acknowledged a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which contains limited information relating to vehicle-loan customers. AU Small Finance Bank said its own banking systems remain unaffected and all banking services are operating normally. However, the bank has not confirmed whether the platform under investigation is connected to the hackers’ claims or how many customers could be affected.
Key Takeaways
- AU Small Finance Bank is investigating a potential data leak involving a Salesforce-hosted platform.
- The platform reportedly contains limited information relating to vehicle-loan customers.
- Hackers using the name ScarlettGroup claim to have accessed PAN, Aadhaar, KYC records and financial documents.
- The bank says its core banking systems remain unaffected and services are operating normally.
- The alleged stolen data and its extent have not been independently verified.
- The incident raises concerns about customer privacy, identity theft and third-party technology security.
What Happened at AU Small Finance Bank?
A hacking group identifying itself as ScarlettGroup has claimed responsibility for a cyberattack involving AU Small Finance Bank.
The group allegedly accessed customer information and internal corporate records and threatened to publish the material if its demands were not met.
The claims were first highlighted by cybersecurity monitoring account @H4ckmanac on X. The alleged data includes personal identification documents, financial records, loan applications and internal business information.
According to Moneylife, the attackers claim to possess:
- Customer KYC records and personal information.
- PAN and Aadhaar details.
- Credit reports and bank statements.
- Loan applications and signed agreements.
- Insurance-related records.
- Customer relationship management (CRM) information.
- Employee details, login histories and audit logs.
However, these details represent the hackers’ own description of the allegedly stolen information. No independent investigation has established that the group possesses all the listed records.
AU Small Finance Bank Confirms Investigation Into Salesforce Platform
AU Small Finance Bank has acknowledged that it is investigating a potential data leak involving a third-party technology platform.
The bank told Business Standard that the platform is managed and hosted by Salesforce and holds limited information relating to its vehicle-loan customers.
The lender also emphasized that its own systems remain unaffected and banking services continue to operate normally.
This distinction is important because the bank has not reported a confirmed compromise of its core banking infrastructure.
AU Small Finance Bank has also not confirmed whether the Salesforce-hosted platform is the source of the information ScarlettGroup claims to have obtained.
The investigation must establish whether unauthorized access actually occurred, what information may have been exposed and whether any customers are affected.
Why Is Salesforce Involved?
Salesforce is a major enterprise software provider whose products help businesses manage customer relationships, sales processes and customer information.
AU Small Finance Bank has an existing technology partnership with Salesforce.
In March 2024, the two companies announced a collaboration to digitize customer onboarding for vehicle loans.
The platform was designed to help the bank manage customer journeys, verify documents, streamline loan processing and improve operational efficiency.
This makes the bank’s latest disclosure particularly relevant: the potential data leak involves a third-party platform used in its vehicle-loan operations.
However, the existence of this partnership does not establish that Salesforce itself suffered a security breach. The investigation has not identified the precise source of the potential exposure or the method through which unauthorized access may have occurred.
Who Is ScarlettGroup?
ScarlettGroup is the name used by the group claiming responsibility for the alleged attack.
Cybersecurity firm Foresiet documented the group’s activity in a report published on October 21, 2026.
According to the research described by Moneylife, ScarlettGroup uses a public extortion approach involving a leak website on the Tor network.
Its reported process includes listing alleged victims, providing a negotiation window and threatening to disclose information if negotiations fail.
The group has also made claims involving other organizations, including Genesys and Rajasthan Police.
However, a group’s claim of responsibility does not independently establish that it carried out an attack. Previous claims and their accuracy must be assessed separately.
For the AU Small Finance Bank incident, the available reporting does not establish the authenticity or completeness of the alleged data.
What Information Could Be at Risk?
If the hackers’ claims are confirmed, the potential exposure could be serious because the information reportedly includes identity documents and financial records.
| Allegedly exposed information | Potential risk |
|---|---|
| PAN details | Identity misuse and fraudulent financial activity |
| Aadhaar details | Identity-related fraud and impersonation |
| Bank statements | Targeted scams using financial information |
| Credit reports | More convincing financial fraud attempts |
| Loan applications | Misuse of personal and financial details |
| Signed agreements | Document impersonation and fraudulent claims |
| Phone numbers and addresses | Phishing, spam and social engineering |
| Employee information | Targeted attacks against bank staff |
These are potential risks, not confirmed incidents of fraud involving AU Small Finance Bank customers.
The most important concern is that criminals could use genuine personal information to make fraudulent calls and messages appear legitimate.
For example, a scammer who knows a customer’s name, loan details or address may pretend to be a bank representative and request an OTP or other confidential information.
What Should AU Small Finance Bank Customers Do?
Customers do not need to panic, but they should remain alert while the investigation continues.
Here are some practical precautions:
- Watch for suspicious calls: Be cautious of callers claiming to represent AU Small Finance Bank, especially if they request confidential information.
- Never share OTPs or PINs: Bank employees should not ask customers to disclose passwords, OTPs, card PINs or internet banking credentials.
- Monitor bank transactions: Check account statements and report unfamiliar transactions immediately.
- Be careful with links: Avoid clicking suspicious links received through SMS, WhatsApp or email.
- Monitor credit activity: Review credit reports for unfamiliar loan applications or accounts.
- Use official support channels: Contact the bank through its verified website or official customer-service channels if you receive suspicious communications.
Customers should not assume their Aadhaar or PAN information has been leaked simply because hackers have claimed to possess it.
What Happens Next?
The immediate priority is determining whether the alleged data exposure is genuine.
The investigation needs to establish:
- Whether unauthorized access occurred.
- Whether the Salesforce-hosted platform was involved.
- What categories of customer information were accessed.
- How many customers, if any, were affected.
- Whether the information was copied, published or misused.
- Whether additional security measures are required.
If a reportable cybersecurity incident is confirmed, the bank will also need to address its applicable regulatory reporting and customer-protection obligations.
The incident highlights the importance of cybersecurity controls across third-party technology providers, not just a bank’s own infrastructure.
The Bigger Picture
Banks increasingly depend on cloud services, software-as-a-service platforms and external technology providers to manage customer onboarding, lending, payments and other operations. These partnerships can improve efficiency, but they also create additional points that must be protected through access controls, monitoring, security assessments and incident-response procedures.
The AU Small Finance Bank investigation illustrates why a potential third-party data exposure can become a significant customer-trust issue even when core banking systems remain operational. The final impact will depend on whether unauthorized access is confirmed, what information was involved and how effectively the bank responds.
Looking Ahead
The next important development will be the outcome of AU Small Finance Bank’s investigation into the Salesforce-hosted platform. Customers and investors will be looking for clarity about the source of the potential leak, the categories of information involved and whether any individuals need to take additional protective measures. A verified disclosure will be necessary before the scale of the incident can be assessed.
For now, the hackers’ claims should not be treated as proof that PAN, Aadhaar or banking records have been stolen. The bank has acknowledged an investigation but maintains that its own banking systems and services remain unaffected. Further updates from the bank, cybersecurity investigators and relevant authorities will determine the actual scope of the incident.
Frequently Asked Questions
1. Was AU Small Finance Bank hacked?
A hacking group called ScarlettGroup claims to have breached the bank. AU Small Finance Bank has acknowledged investigating a potential data leak involving a Salesforce-hosted platform, but the full allegations have not been independently verified.
2. Were customer PAN and Aadhaar details leaked?
Hackers claim to possess PAN and Aadhaar information. However, the bank has not confirmed that these documents were exposed, and the alleged data has not been independently authenticated.
3. Is Salesforce involved in the AU Small Finance Bank incident?
The bank confirmed that it is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce. The platform contains limited information relating to vehicle-loan customers. The precise source of the alleged exposure remains unknown.
4. Are AU Small Finance Bank’s banking services affected?
The bank says its own systems remain unaffected and all banking services are operating normally.
5. Who is ScarlettGroup?
ScarlettGroup is a hacking group that has claimed responsibility for attacks against multiple organizations. Cybersecurity researchers describe its approach as involving public extortion threats and alleged data leaks.
6. What should AU Small Finance Bank customers do?
Customers should monitor transactions, remain alert to suspicious calls and messages, avoid sharing OTPs or passwords, and contact the bank through official channels if they notice unusual activity.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
