AU Small Finance Bank probes Salesforce-hosted data leak after ScarlettGroup extortion claim

What happened

AU Small Finance Bank said it is investigating a potential data leak involving a software-as-a-service platform managed and hosted by Salesforce, which it says holds limited data relating to its vehicle loan customers. The bank also said its own systems remain unaffected and all banking services are operating normally (BusinessLine, MediaNama).

The incident became public after cyber threat intelligence account Hackmanac reported that a group identified as ScarlettGroup claimed to have breached the bank and threatened to leak customer and internal corporate data (Mint, ETCISO). Mint dates the Hackmanac post to October 30, 2026, while BusinessLine’s PTI report calls it a Thursday post, so the exact day is not confirmed.

What the group claims, as reported:

• Customer KYC data such as PAN and Aadhaar details, photos and signatures.
• Credit and financial records such as CIBIL reports, bank statements and loan applications.
• Signed loan documents.
• CRM records.
• Employee directories, login history, IP addresses and audit logs.

MediaNama reviewed the dark web listing and says the claimed scope is far broader than the “limited data” the bank acknowledged (MediaNama). The listing was marked “negotiation” with a countdown, and Mint reports the group threatened to release the data if the bank does not negotiate within six days. MediaNama saw a countdown of five days and 17 hours at the time of writing. The sources differ on samples: Mint says blurred document samples were displayed, while MediaNama says the group had not publicly released any data samples or complete datasets, only redacted screenshots. MediaNama could not independently verify that the group holds any original AU data, and Mint says the claims have not been independently verified.

On October 31, Salesforce said that, based on currently available information, it has not identified a vulnerability in the Salesforce platform related to this issue. It said it does not comment on specific customer issues and is supporting customers as needed (BusinessLine). How the data was accessed is not confirmed.

Other details from the reporting:

• The bank has not disclosed the nature or volume of the data, the number of customers affected, or whether financial data was involved (ETCISO).
• ETCISO reports the bank has a 100 crore rupee cyber insurance cover from New India Assurance but, per people familiar with the matter, had not yet informed the insurer. As of November 4, the extent of exposure and the number of customers affected were still to be established (ETCISO).
• MediaNama says the same group also claims to hold Rajasthan Police data. That claim is unconfirmed, and MediaNama had asked the police for comment.

Am I affected?

• AU Small Finance Bank customers: possibly, especially vehicle loan customers, since the bank says that is the data held on the platform. Whether any individual customer was exposed is not confirmed.
• Anyone whose Aadhaar, PAN, KYC, loan or credit data was shared with the bank: the group’s listing claims such data, but the claim is unverified and the bank has not confirmed it.
• AU employees: the listing claims employee directories, permissions and audit logs. The bank has not addressed this (MediaNama).
• Other Salesforce customers: Salesforce says it has found no platform vulnerability related to this issue. No other Salesforce customers are named in the sources.

What to do now

1. Be wary of suspicious calls, emails and messages that appear to come from AU Small Finance Bank (Mint).
2. Do not share OTPs, banking passwords, Aadhaar details or other sensitive information with unknown callers.
3. Watch your bank statements and report any suspicious activity to your bank as soon as it occurs.
4. Wait for official notice from AU Small Finance Bank on whether your data was involved. As of the latest report, affected customers had not been identified.
5. If you run a Salesforce environment, review user access, login history and audit logs for unexpected activity. This is general hygiene, not a fix confirmed by the sources.
6. Do not rely on leak-site claims alone. Treat them as unverified until the bank or regulators confirm scope.

Sources

• Mint
• BusinessLine, AU Small Finance Bank probes potential data leak
• ETCISO, AU Small Finance Bank hit by a likely breach of limited data
• MediaNama
• BusinessLine, Salesforce says no vulnerability at its end
• ETCISO, rising risks to financial institutions