AU Small Finance Bank Data Breach Claim (October 2026): What Was Claimed and What to Do

What happened

On Friday 30 October 2026, AU Small Finance Bank, based in Jaipur, told reporters it was looking into a possible data leak. A spokesperson said the system in question is a software-as-a-service platform “managed and hosted by Salesforce” that holds limited data on its vehicle loan customers, according to ThePrint. The bank said its own systems were unaffected and banking services were running normally.

The statement followed a claim made a day earlier. A group calling itself ScarlettGroup claimed to have taken customer and internal corporate data from the bank. The group listed KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs. ThePrint said it could not verify any of this. We treat every item in the list above as a claim.

What the bank has and has not said

The bank has confirmed an investigation. It has not said whether the Salesforce platform is the source of whatever the group holds. It has not given a number of affected customers or said whether any data has been verified as genuine.

For scale, ThePrint reports that AU’s vehicle loan book has passed Rs 50,000 crore and serves more than 13.7 lakh customers. That is the size of the customer group, not a count of exposed records. The bank’s shares fell about 2 percent on the BSE on the day of the news, according to The Hans India.

Who is behind the claim

Security firm Foresiet described ScarlettGroup on 21 October as a group that runs a Tor leak site, names victims and gives them a window to negotiate before publishing, per ThePrint. The same group claimed on BreachForums to have breached Rajasthan Police in the same month, and a Rajasthan cybercrime official told ThePrint the state had information that the group had obtained data from several government departments. Salesforce told the press in earlier, unrelated cases that it saw no sign of its own platform being compromised. ThePrint found no evidence linking those cases to this one.

Why the claimed data matters

If real, a bundle of PAN, Aadhaar, bank statements and signed loan papers is the raw material for identity fraud. It also lets a caller sound like the bank. Vehicle loan borrowers should expect convincing calls about EMIs, foreclosure or “KYC expiry”. Read our guides on phishing messages, government impersonation scams and what to do after a data breach before answering any unexpected call.

What is still unknown

Whether any customer data was taken, how many people it covers, and whether the platform is the true source. No regulator filing or CERT-In statement on the AU case had been published when we checked. We will update this page as the bank or authorities say more. See other incidents in our breach tracker and how we handle unconfirmed claims in our editorial policy.

This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.