AU Small Finance Bank Hit By Alleged Cyberattack; Hackers Claim PAN, Aadhaar Data Stolen

A hacking group calling itself ScarlettGroup has claimed it breached AU Small Finance Bank, alleging it stole sensitive customer and internal data, including PAN and Aadhaar details, KYC records, bank statements, credit reports and loan files. The group has also threatened to publish the material online. The bank has not yet acknowledged the incident, and the claims remain unverified. If genuine, the exposure could leave customers vulnerable to identity theft, financial fraud and other scams targeting affected bank account holders.

The claim was first flagged by the cybersecurity monitoring account @H4ckmanac on X. As per the post, the attackers say they accessed KYC records and personal identification documents belonging to customers, among them PAN and Aadhaar details. The alleged haul reportedly goes beyond basic identity information. It covers credit reports, bank statements, loan applications and signed agreements, along with insurance-related records and customer relationship management (CRM) data.

The group also says it has internal material. This includes employee details, login histories and audit logs.

Leak threat and bank's silence

ScarlettGroup has reportedly warned that it will make the data public. AU Small Finance Bank had not confirmed the breach or responded to the claims. The authenticity of the data and the extent of any compromise have not been independently established.

Why it matters

Documents like PAN, Aadhaar, bank statements and signed loan papers are the raw material for impersonation and fraud. If the data is genuine and gets released, it could be used to open fraudulent accounts, take out loans in someone else's name or run convincing phishing campaigns that quote real financial details.

What customers should do

Customers have been advised to stay alert to suspicious calls, messages and emails. They should not share PAN, Aadhaar, banking passwords, OTPs or other personal details with unknown parties. They should also monitor their accounts for unusual activity.