AU Small Finance Bank Data Breach Explained: Salesforce Vehicle Loan Data Leak, Unverified Claims and What Customers Should Do

Illustrative image: a padlock over a circuit-board pattern — a cybersecurity concept image, not AU Small Finance Bank's platform or data. Image: Wikimedia Commons / jaydeep_, CC0.

TL;DR — AU Small Finance Bank data breach explained in one line: on 30 October 2026 the bank said it is investigating a potential leak from a Salesforce-managed platform holding limited vehicle-loan customer data, after hacker group ScarlettGroup claimed a breach — while stressing its own systems are unaffected, services are normal, and the hackers' claims remain unverified.

UPDATE — 31 October 2026: Salesforce has now responded. In a statement on Saturday 31 October, reported by The Economic Times, Salesforce said it has "not identified a vulnerability in the Salesforce platform related to this issue" based on currently available information, while noting it does not comment on specific customer issues as a matter of policy and that its teams are proactively engaged to support customers. AU Small Finance Bank, which said on Friday 30 October that it is investigating a potential data leak involving a Salesforce-managed and hosted SaaS platform holding limited data relating to its vehicle-loan customers, reaffirmed that its own systems remain unaffected and all banking services are operating normally. The ScarlettGroup hacking group's breach claim remains unverified — no independent confirmation of accessed data has emerged. Source: The Economic Times, "AU Small Finance Bank data leak: Salesforce says no vulnerability at its end" (31 Oct 2026).

📌 KEY HIGHLIGHTS

• Confirmed 30 October 2026: AU Small Finance Bank is investigating a potential data leak involving a Salesforce-managed SaaS platform holding limited data on its vehicle-loan customers.
• Bank's position: its own systems remain unaffected and all banking services are operating normally, the bank said in a statement carried by Reuters, Business Standard, Moneycontrol and ETBFSI.
• The claim: hacker group ScarlettGroup listed the bank on its leak site on 29 October and claims to hold KYC records, PAN and Aadhaar details, bank statements, credit reports and loan agreements.
• Unverified: the claimed exposure has not been independently verified, and the bank has not confirmed how many customers, if any, are affected.
• Market reaction: AU Small Finance Bank shares traded at ₹865.70 on the NSE at 1:27 pm on 30 October, down 1.7% from the previous close.

AU Small Finance Bank data breach explained: what happened?

AU Small Finance Bank (AU SFB) confirmed on Friday, 30 October 2026, that it is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce. The platform holds limited data relating to the bank's vehicle-loan customers — the "Wheels" business that, the bank told investors on its 27 April 2026 earnings call, runs entirely on Salesforce's loan-origination system.

The bank's full statement, sent to several outlets on 30 October, reads: "AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers. We reaffirm that the Bank's own systems remain unaffected and all banking services are operating normally."

The disclosure followed a claim by a hacking group calling itself ScarlettGroup, which listed the bank on its leak site on 29 October, according to ETBFSI, with threat-monitoring account Hackmanac flagging the listing on X. A person with knowledge of the matter told The Hindu BusinessLine that the issue was under investigation across all verticals, even though only the Wheels vertical may have had "potential breaches".

What data does ScarlettGroup claim to hold — and what is confirmed?

This is where readers need to be careful: there is a sharp line between what the bank confirmed and what the hackers claim. The table below keeps them separate.

Data / claim	Status on 31 October 2026
Potential leak on a Salesforce-managed platform holding limited vehicle-loan customer data	Confirmed — under investigation, per the bank's 30 October statement
Bank's own systems unaffected; services operating normally	Confirmed — the bank's statement
KYC records, PAN and Aadhaar details, bank statements, credit reports, loan applications and signed agreements	Claimed by ScarlettGroup — NOT independently verified, NOT confirmed by the bank
CRM data, employee records, login histories and audit logs	Claimed by ScarlettGroup — NOT independently verified
Number of customers affected	Unknown — the bank has not given a figure; it reported 12.2 million unique customers at the end of FY26

Illustrative image: a bank ATM in India — not an AU Small Finance Bank branch or system. Image: Wikimedia Commons, CC BY 3.0.

Business Standard notes that the bank has not said whether the Salesforce-hosted platform under investigation is the source of the data ScarlettGroup claims to hold — a gap that matters, because the platform is described as holding only "limited" vehicle-loan data, while the hackers' claimed haul is far broader. Mint has also reported a "negotiation deadline" countdown of about six days on the group's leak page, a common pressure tactic in extortion-style claims.

Why it matters for India readers

AU SFB is the third Indian lender in recent months to face a public data-security scare. State Bank of India told the stock exchanges on 21 October 2026 that 3,897 customer records containing personal information had turned up on the dark web, out of roughly 375,000 records assessed. Bank of Baroda reported a security incident in July 2026 after a compromised employee email account gave unauthorised access to certain information. And on 9 October 2026, CERT-In issued a critical advisory (CIAD-2026-0046) warning banks, NBFCs and fintechs that attackers were draining payment and disbursement APIs using stolen credentials.

The pattern behind all of these is the same one CERT-In flagged: the weakest point is often not the bank's core system but a connected third-party platform, an API or an exposed credential. For customers, that distinction matters less than the practical question — what, if anything, of mine is out there? On that, AU SFB has so far said only that the platform under investigation holds "limited" vehicle-loan data, and has not confirmed any customer impact. This post will be updated when the bank says more.

For context on how fast such claims can escalate, see our coverage of the Binance suspected hack and the frozen billions and the MUJI app data leak affecting up to 27.26 million records — and the Philippines migrant worker data breach, where 68GB of backups were copied in 24 minutes.

Should you care?

✅ Verdict: If you hold an AU Small Finance Bank vehicle loan, pay attention but don't panic — the bank says its own systems and services are unaffected, and the alarming data claims are still unverified. ⏳ If you are not an AU SFB customer, this is still a useful warning: check what third-party platforms hold your KYC documents, and treat any "your data leaked" message claiming to be from your bank with suspicion until the bank confirms it.

What AU Small Finance Bank customers should do now

Until the bank confirms more, the sensible steps are the standard ones for any suspected bank data incident: watch for unusual calls, SMS or emails asking for OTPs or KYC "re-verification" — banks never ask for OTPs; check your loan and bank statements for transactions you don't recognise; turn on transaction alerts if you haven't; and don't click links in messages claiming your AU SFB data leaked. If you are contacted by someone claiming to hold your data, report it to the bank and to cybercrime.gov.in rather than engaging.

FAQs

What happened in the AU Small Finance Bank data breach?
On 30 October 2026, AU Small Finance Bank said it is investigating a potential data leak involving a Salesforce-managed SaaS platform that holds limited data on its vehicle-loan customers. The investigation followed a breach claim by hacker group ScarlettGroup, which listed the bank on its leak site on 29 October.

Is AU Small Finance Bank safe? Are deposits and services affected?
The bank says its own systems remain unaffected and all banking services are operating normally. The investigation concerns a third-party Salesforce-hosted platform, not the bank's core banking systems, according to the bank's statement.

What customer data was leaked in the AU Small Finance Bank breach?
That is not yet established. ScarlettGroup claims to hold KYC records, PAN and Aadhaar details, bank statements, credit reports and loan agreements, but those claims have not been independently verified and the bank has not confirmed them or given a count of affected customers.

What should AU Small Finance Bank customers do now?
Stay alert for phishing calls, SMS and emails asking for OTPs or KYC re-verification, check loan and bank statements for unfamiliar transactions, keep transaction alerts on, and report suspicious contact to the bank and cybercrime.gov.in. Do not engage with anyone claiming to hold your data.

Has AU Small Finance Bank confirmed the data breach?
The bank has confirmed an investigation into a "potential data leak" on the Salesforce platform. It has not confirmed that customer data was actually accessed or leaked, and the hackers' claims remain unverified as of 31 October 2026.

Takeaway: A confirmed investigation, an unconfirmed claim — and a reminder that your data's safety depends on every platform that holds it, not just your bank. Watch for the bank's next update before treating any leaked-data list as fact.

Follow India Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• The Hindu BusinessLine — AU Small Finance Bank investigates suspected Salesforce data breach (30 October 2026)
• Business Standard — AU Small Finance Bank probes potential data leak on Salesforce platform (30 October 2026)
• Moneycontrol — Hacker group alleges data breach at AU Small Finance Bank; lender said to be investigating (30 October 2026)
• ETBFSI — AU Small Finance Bank investigates potential data leak linked to Salesforce (30 October 2026)
• The Tribune (ANI) — AU Small Finance Bank probes potential customer data leak (30 October 2026)