AU Small Finance Bank Probes Possible Vehicle Loan Data Breach Affecting Customer Information

AU Small Finance Bank is investigating a potential data leak involving a third-party software platform used to onboard its vehicle-loan customers. The Jaipur-headquartered lender disclosed the incident in a November 2, 2026, filing to the stock exchanges, stating that preliminary findings indicated a possible leakage of information belonging to some customers. The bank became aware of the incident on October 29 and has initiated internal and external forensic investigations with the assistance of cybersecurity firms.

The platform was used to onboard approximately 28.5 lakh vehicle-loan customers, although this does not mean that all those customers were affected by the incident. The bank has not yet established the exact nature or volume of information potentially exposed. It said its other systems remain unaffected, banking services are operating normally, and the incident has not affected its financial performance or business continuity. The matter has also been reported to the Reserve Bank of India (RBI) and CERT-In.

AU Small Finance Bank Confirms Potential Data Leakage

AU Small Finance Bank’s November 2 regulatory disclosure provided additional details about the incident first reported on October 30.

The lender said the potential data leakage involved a software-as-a-service (SaaS) platform hosted and managed by a global third-party vendor. The platform is used during the onboarding process for vehicle-loan customers and contains information collected when customers apply for financing.

According to the bank, preliminary findings suggest that some customer information may have been exposed.

The lender is conducting a detailed investigation to establish:

• What information may have been accessed or leaked.
• How the potential incident occurred.
• How many customers may have been affected.
• Whether the exposed information was accessed or misused.
• What additional security measures may be required.

The bank has engaged leading cybersecurity firms to support the investigation.

Importantly, the 28.5 lakh figure represents the number of vehicle-loan customers onboarded through the platform, not the confirmed number of individuals affected by the potential breach.

Salesforce Platform Linked to Vehicle Loan Onboarding

Media reports identified the third-party platform as Salesforce, a customer relationship management (CRM) and enterprise software provider.

AU Small Finance Bank had partnered with Salesforce in March 2024 to digitise the customer onboarding journey for vehicle loans.

The platform helps manage information and processes associated with customer applications. Such systems can contain personal and financial information collected during the loan application process.

The bank has emphasised that the potential incident concerns the third-party platform rather than its own core banking systems.

However, the bank’s regulatory disclosure did not publicly establish the precise technical cause of the incident or independently confirm that every allegation made by the hacking group relates to the platform under investigation.

Salesforce’s involvement as the platform provider should also not be interpreted as proof that its wider systems were compromised.

Hacker Group ScarlettGroup Claims to Have Breached the Bank

The investigation follows claims by a hacking group identifying itself as ScarlettGroup.

The group reportedly threatened to publish customer information and internal corporate records that it claimed to have obtained from the bank.

Cybersecurity monitoring platform Hackmanac flagged the group’s claims, while media reports described the alleged information as including:

• Know Your Customer (KYC) records.
• PAN and Aadhaar details.
• Customer bank statements.
• Credit reports.
• Loan applications and signed agreements.
• Insurance-related records.
• Customer relationship management information.
• Employee records and internal audit logs.

These details are allegations made by the attackers and reported by cybersecurity monitoring sources. They have not been independently verified, and AU Small Finance Bank has not confirmed that all these categories of information were exposed.

The exact scope of the incident remains subject to the ongoing forensic investigation.

A distinction is important here: a hacker group’s claim of having stolen sensitive records does not establish that the information is authentic, complete or actually taken from the bank’s systems.

Bank Says Core Systems and Banking Services Are Unaffected

AU Small Finance Bank has sought to reassure customers and investors that the incident has not disrupted its banking operations.

In its regulatory filing, the lender stated that its other systems remain unaffected and that all services are operating normally.

It also said the incident has not affected its business operations, financial performance or business continuity.

The bank has reported the matter to regulatory authorities, including:

• Reserve Bank of India (RBI): India’s banking regulator.
• CERT-In: The Indian Computer Emergency Response Team, which coordinates responses to cybersecurity incidents.

The involvement of these authorities is part of the bank’s regulatory reporting and incident-response process.

The lender has said it will continue monitoring the situation and make additional disclosures if required.

What Could the Potential Data Leak Mean for Customers?

The main concern is the possibility that personal information collected during vehicle-loan applications could be accessed by unauthorised individuals.

If sensitive information such as identity documents, financial records or loan details were exposed, affected customers could face risks including phishing, identity theft and fraudulent loan-related communications.

Criminals can use personal information to make fraudulent messages appear genuine. For example, a scammer who knows a customer’s loan details might impersonate a bank representative and request additional documents, passwords or one-time passwords.

Customers should therefore remain cautious about unexpected calls, emails and messages claiming to come from the bank.

Practical precautions include:

• Never share OTPs, passwords or banking PINs with anyone.
• Avoid opening suspicious links sent through SMS, email or messaging applications.
• Do not share Aadhaar, PAN or bank statements with unverified contacts.
• Verify unexpected loan-related requests directly through official bank channels.
• Report suspicious transactions or communications to the bank immediately.

These precautions are sensible while the investigation continues; they do not mean that customers’ accounts or credentials have been confirmed compromised.

AU Small Finance Bank’s Cybersecurity Exposure

The incident highlights the security challenges financial institutions face when they rely on external technology providers.

Banks increasingly use cloud-based platforms and SaaS products for customer onboarding, loan processing, CRM, analytics and other operations. These systems can improve efficiency, but they also introduce additional security dependencies.

A breach involving a third-party platform can create risks even when a bank’s core banking infrastructure remains unaffected.

Financial institutions therefore need to assess vendors’ cybersecurity controls, access permissions, data storage practices and incident-response procedures.

AU Small Finance Bank’s investigation will need to establish whether the incident originated from a vulnerability, compromised credentials, unauthorised access or another security weakness. The bank has not yet disclosed a confirmed technical explanation.

The Bigger Picture

The AU Small Finance Bank incident comes amid renewed cybersecurity concerns across India’s banking industry. State Bank of India recently disclosed a separate suspected exposure involving customer records identified on the dark web. A preliminary examination of approximately 3.75 lakh records reportedly identified 3,897 SBI customer records containing personally identifiable information.

These incidents highlight the importance of protecting customer information across the entire financial technology ecosystem, including external vendors and cloud platforms.

For banks, cybersecurity is no longer limited to securing internal networks. It also requires continuous monitoring of third-party systems, strong authentication, vendor oversight and rapid investigation of suspicious activity.

The AU Small Finance Bank case also demonstrates why the number of customers using a platform should not be confused with the number of confirmed victims in a data breach.

Looking Ahead

The next important development will be the outcome of AU Small Finance Bank’s internal and external forensic investigations. The findings should establish what information may have been exposed, how the incident occurred and whether customers need to take additional protective measures. The bank may also provide further regulatory disclosures as more information becomes available.

For now, the lender says its core systems and banking services remain unaffected, while the potential data leakage is still under investigation. The final assessment of the incident will depend on forensic evidence rather than the claims made by the hacking group.