AU Small Finance Bank is investigating a potential data leak involving a software platform managed and hosted by Salesforce, after a hacking group claimed to have breached the lender and threatened to publish customer information. Salesforce said on Saturday 31 October that, based on currently available information, it had not identified any vulnerability in its platform related to the issue. The bank said its own systems remain unaffected and that all banking services are operating normally.

What the hackers claim — and what is unverified

The group, identified by threat-intelligence platform Hackmanac as ScarlettGroup, claimed to hold customer know-your-customer records, identity documents, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements, as well as customer-relationship data, employee information, login histories and audit logs. Those claims have not been independently verified, and the bank has not confirmed how many customers, if any, are affected, or whether the Salesforce platform is the source of the claimed data. A person familiar with the matter told BusinessLine that claims about know-your-customer data were unverified and unvalidated, and that only the bank's vehicle-loan business, known as Wheels, may have had a potential breach.

Why third-party platforms are in focus

The case highlights the risk banks face when customer data sits on a supplier's system rather than their own. The platform at the centre of the investigation holds limited data relating to the bank's vehicle-loan customers, according to the bank, while its core banking system is said to be safe. Similar claims in recent days have touched other Indian lenders, and India's prime minister warned on 25 October about cyberattacks aimed at weakening the economy. Until the bank's investigation concludes, customers cannot know from public statements alone whether any of their details were actually exposed, and the bank has given no timetable for its findings.