# AU Small Finance Bank investigates data leak on its Salesforce platform · pwn.watch > AU Small Finance Bank, an Indian lender with about 12.2 million customers, is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers. The probe follows claims by the ScarlettGroup hacking group that it stole and will leak KYC records, PAN and Aadhaar details, credit reports, bank statements, loan agreements, CRM data, employee records and audit logs. The bank says its own systems are unaffected and services run normally; it has not confirmed the hackers' claims or how many customers are affected. Expect targeted phishing and loan-related fraud calls. Page: https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026 · generated 2026-10-30T10:23:38.556Z ## Status - Severity: medium · status: live · patch: partial - Product: AU Small Finance Bank customer data (Salesforce SaaS platform) - Started: 2026-10-29 - Affected: Vehicle loan customer data held on AU Small Finance Bank's Salesforce-hosted SaaS platform (scope not disclosed) - Fixed in: Under investigation by the bank; no containment details or customer notification announced yet ## Follow this incident - RSS (one item per update): https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026.json - This file: https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: AU Small Finance Bank says it is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers, and that the bank's own systems are unaffected. (https://www.moneycontrol.com/news/business/banks/au-small-finance-bank-probes-potential-data-leak-after-hacker-group-threat-14064387.html) - 2026-10-29: The ScarlettGroup hacking group claims to have breached AU Small Finance Bank and threatens to leak customer KYC, PAN and Aadhaar details, loan records, CRM data, employee records and audit logs. (https://www.timesnownews.com/technology-science/au-small-finance-bank-investigates-alleged-data-leak-hackers-claim-pan-aadhaar-theft-article-156434207) ## Fix brief # Security brief: AU Small Finance Bank investigates data leak on its Salesforce platform Source: https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 08:10 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is AU Small Finance Bank, an Indian lender with about 12.2 million customers, is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers. The probe follows claims by the ScarlettGroup hacking group that it stole and will leak KYC records, PAN and Aadhaar details, credit reports, bank statements, loan agreements, CRM data, employee records and audit logs. The bank says its own systems are unaffected and services run normally; it has not confirmed the hackers' claims or how many customers are affected. Expect targeted phishing and loan-related fraud calls. Severity detail: Bank confirms a potential leak of limited vehicle loan customer data on a Salesforce-hosted platform; the attackers' broader claims are unconfirmed - Product: AU Small Finance Bank customer data (Salesforce SaaS platform) ## Affected versions - Vehicle loan customer data held on AU Small Finance Bank's Salesforce-hosted SaaS platform (scope not disclosed) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Under investigation by the bank; no containment details or customer notification announced yet After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 30, 2026: AU Small Finance Bank says it is investigating a potential data leak involving a SaaS platform managed and hosted by Salesforce that holds limited data on its vehicle loan customers, and that the bank's own systems are unaffected. - Oct 29, 2026: The ScarlettGroup hacking group claims to have breached AU Small Finance Bank and threatens to leak customer KYC, PAN and Aadhaar details, loan records, CRM data, employee records and audit logs. ## Write-ups & news - [AU Small Finance Bank probes 'potential data leak' after hacker group claims breach](https://www.moneycontrol.com/news/business/banks/au-small-finance-bank-probes-potential-data-leak-after-hacker-group-threat-14064387.html) - [Au Small Finance Bank says investigating potential data leak involving SaaS platform](https://economictimes.indiatimes.com/industry/banking/finance/au-small-finance-bank-says-investigating-potential-data-leak-involving-saas-platform/articleshow/135350044.cms) - [AU Small Finance Bank: ScarlettGroup claims data breach; bank says systems unaffected](https://www.cnbctv18.com/market/au-small-finance-bank-scarlettgroup-claims-data-breach-share-price-20023170.htm) - [AU Small Finance Bank Investigates Alleged Data Leak: Hackers Claim PAN, Aadhaar Theft](https://www.timesnownews.com/technology-science/au-small-finance-bank-investigates-alleged-data-leak-hackers-claim-pan-aadhaar-theft-article-156434207) ## Caveats The list of stolen data comes from the attackers' claims; the bank has only confirmed a potential leak of limited vehicle loan customer data. --- Machine-readable: https://pwn.watch/i/au-small-finance-bank-salesforce-data-leak-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.