AU Small Finance Bank probes potential data leak
The investigation follows claims by a hacking group called ScarlettGroup that it had breached the lender's records and threatened to release the allegedly compromised information.
2 min read
AU Small Finance Bank (AU SFB) is investigating a potential data leak involving a third-party software platform hosted by Salesforce that holds limited information relating to its vehicle loan customers, media reports said citing a bank spokesperson.
The Jaipur-headquartered lender said its own systems remain unaffected and all banking services are operating normally.
The investigation follows claims by a hacking group called ScarlettGroup that it had breached the lender's records and threatened to release the allegedly compromised information.
According to cybersecurity monitoring platform Hackmanac, the group claims to have accessed sensitive customer and internal corporate data, including know-your-customer (KYC) records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements and insurance records.
The alleged data exposure also includes customer relationship management (CRM) data, employee information, login histories and audit logs.
The claims have not been independently verified. AU SFB has not confirmed whether the Salesforce-hosted platform is the source of the data the group claims to possess. The lender has also not disclosed the number of customers who may have been affected.
AU SFB partnered with Salesforce in March 2024 to digitise the onboarding process for its vehicle loan customers.
The collaboration was aimed at bringing the customer journey across credit and operations onto a single platform, reducing manual data entry and streamlining data validation.
The potential data leak comes amid heightened scrutiny of cybersecurity risks in India's banking sector, particularly as lenders expand their digital infrastructure and rely on third-party technology platforms.
Last month, CERT-In had said that AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing. CERT-In did not disclose the names of the affected organisations.
Later, State Bank of India (SBI), the country's largest lender, has reported a suspected exposure of customer data on the dark web, with 3,897 customer records containing personal information identified during a preliminary analysis.