AU Small Finance Bank probes Salesforce data leak claim

AU Small Finance Bank says it is investigating a possible data breach on its Salesforce application after a hacking group calling itself ScarlettGroup claimed to have taken sensitive customer and internal records. The group has threatened to publish the material unless the bank opens negotiations within six days.

The claim surfaced on October 30, 2026, in a post on X by the cybersecurity monitoring account H4ckmanac. ScarlettGroup has posted a countdown labelled "Negotiation deadline" along with blurred samples of documents. How much data was taken and how many customers are affected remains unclear, and the claims have not been independently verified.

What the bank says

The bank acknowledged that its Salesforce app may have been affected. The platform is a software-as-a-service system managed and hosted by Salesforce. According to the bank's statement, it holds only a small amount of information about vehicle finance customers.

"The matter is under investigation. We would like to reaffirm to all stakeholders that the bank's systems remain unaffected, and all services are operating normally," the bank said. It stressed that its main banking systems were not involved, but it has not said how many records were exposed or what types of data were included.

What the hackers claim

According to the information attributed to ScarlettGroup, the allegedly compromised data includes Aadhaar numbers, PAN details and KYC documents; CIBIL scores, credit reports, bank statements and loan applications; loan approvals, signed paperwork and security information; insurance documents and CRM data; and internal data such as employee directories, login history, IP addresses and audit logs.

What customers should do

Customers should be wary of suspicious calls, emails and messages that appear to come from the bank. They should not share OTPs, banking passwords, Aadhaar details or other sensitive information with unknown callers, and should monitor their statements and report unusual activity to the bank immediately. The investigation is ongoing, and the bank has yet to provide further details on any potential exposure.