AU Small Finance Bank Probes Salesforce Data Leak Claim

AU Small Finance Bank (AU SFB) says it is investigating a potential data leak on a Salesforce-hosted software platform that holds limited information on its vehicle loan customers. The Jaipur-based lender insists its own systems are unaffected and that all banking services are running normally.

The probe follows a post by the cybersecurity tracking account Hackmanac on X. A group calling itself ScarlettGroup claimed to have breached the lender's records and threatened to publish the data. It says the haul includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements and insurance records, plus CRM data, employee information and audit logs. None of these claims has been independently verified.

The bank has not said whether the Salesforce-hosted platform is the source of the data the group claims to hold, nor how many customers could be affected. AU SFB partnered with Salesforce in 2024 to digitise onboarding for vehicle loan customers. Salesforce customers have previously been targeted through social engineering, including voice phishing that tricked employees into connecting malicious apps to corporate accounts. However, there is no verified evidence linking the AU SFB incident to those campaigns or showing that Salesforce's core platform was compromised.

Vijay Sales listing

Separately, an actor using the handle 'shinymontanna' claims to be selling super administrator access to electronics retailer Vijay Sales for $25,000, according to a post shared by the X account DarkWeb Informer. The listing claims more than 3 million order records, data on 15,000 employees and billing records for about 1.4 lakh vendors, with permissions to view, modify and export data. Screenshots of administrative dashboards have circulated, but the extent of any access, and whether data was extracted, is unconfirmed. Vijay Sales did not respond to queries.

A busy month for Indian data security

The incidents follow other recent cases. SBI flagged the exposure of 3,897 customer records on the dark web, and cybersecurity firm eMudhra said it will wind down its global SSL/TLS certificate business after a researcher found private keys tied to eight intermediate certificate authorities could be recovered. eMudhra says it revoked all eight, issued no certificates from them and suffered no breach.