AU Small Finance Bank (AU SFB) is investigating a potential data leak involving a third-party software-as-a-service (SaaS) platform managed and hosted by Salesforce. The platform holds limited data on the bank's vehicle loan customers. The lender said its own systems have not been affected.
AU Small Finance Bank's response
In a statement, the bank said the platform in question holds limited information related to its vehicle loan customers. It said its internal systems remain unaffected. "All banking services are operating normally," the lender said.
Hacker group's claim
The bank's disclosure came after a hacking group called ScarlettGroup claimed to have breached the lender and threatened to leak sensitive customer and internal corporate data, according to a social media post by Hackmanac. The group claimed on a dark web leak site that the data includes KYC records, PAN and Aadhaar details, bank statements, credit reports, CIBIL scores, loan agreements, CRM data and employee audit logs.
The bank did not say whether the Salesforce platform is the source of the data the group claims to hold, or how many customers may have been affected.
Salesforce says no vulnerability found
Salesforce said on Saturday that it has not identified any vulnerability at its end in connection with the suspected leak at AU SFB. The company added that its teams are working with customers and are available to support them as needed.
Why vehicle loans matter to AU SFB
AU SFB tied up with Salesforce in March 2024 to digitise onboarding of its vehicle loan customers. Vehicle loans are the bank's oldest business: AU began in 1996 as a vehicle finance company and became a small finance bank in 2017. Its vehicle loan book crossed Rs 50,000 crore in assets under management this year. The segment serves over 13.7 lakh customers and accounts for nearly a third of the bank's loans.
What customers should watch for
Customers have been advised to be wary of suspicious calls, emails and text messages, especially those about vehicle loans, repayments, KYC updates or account verification. Anyone who receives an unexpected request for an OTP or other confidential details should not share them and should verify the contact through the bank's official channels.
The bank's investigation is ongoing, and it has not yet said when it expects to share its findings.
