AU Small Finance Bank is investigating claims of a data leak involving sensitive customer and internal records hosted on a Salesforce platform. Separately, a threat actor alleges super administrator access to Vijay Sales’ systems is up for sale for $25,000.
- AU SFB probes possible leak of vehicle loan data on Salesforce-hosted platform
- Hacker group claims access to KYC, bank statements, and internal employee records
- Vijay Sales admin system access listed for $25,000, claims unverified
What happened
AU Small Finance Bank (AU SFB) has initiated an investigation after a hacker group known as ScarlettGroup claimed to have breached a Salesforce-hosted platform used for managing vehicle loan customer information. The group alleges possession of sensitive data including KYC documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, and employee records. The bank confirmed the probe but stated that its internal systems remain unaffected and that banking services are operational.
In a separate incident, a threat actor on the dark web using the handle 'shinymontanna' reportedly offered super administrator access to Vijay Sales’ internal systems for $25,000. This alleged access supposedly includes control over customer orders, employee information, billing data, inventory, and financial records. However, neither the extent of this access nor any data extraction has been independently verified, and Vijay Sales has not publicly responded to the claims.
Why it matters
The potential data leak at AU Small Finance Bank highlights ongoing cybersecurity risks associated with third-party SaaS platforms in the banking sector. Since AU SFB partnered with Salesforce in 2024 to digitize vehicle loan onboarding, this incident underscores challenges in securing outsourced digital infrastructure that stores sensitive personal and financial data. The breach, if confirmed, could expose thousands of customers to identity theft and financial fraud.
The Vijay Sales administrator access listing raises alarm over vulnerabilities in retail digital systems, particularly the risk of wide-ranging internal system control falling into malicious hands. Super admin rights would grant the capability to manipulate data, including orders, payments, and employee records, threatening customer privacy and business operations. Both incidents come amid a broader environment of escalating cyber threats targeting Indian enterprises.
What to watch next
AU Small Finance Bank’s ongoing investigation will be closely monitored for confirmation of the breach scope and the effectiveness of response measures, including any regulatory scrutiny and customer notification. Updates on whether the data on Salesforce’s platform was definitively compromised will also be crucial for assessing risks to users and future security of SaaS-integrated banking solutions.
Vijay Sales’ response to the alleged administrator access sale will be an important indicator of their cybersecurity posture. Independent verification of the claim’s authenticity and any discovered data exposures will influence how retail sector stakeholders approach internal access controls and threat detection. More broadly, Indian financial and retail institutions may accelerate efforts to harden defenses against increasingly sophisticated cyberattacks.