AU Small Finance Bank (AU SFB) is investigating a possible data leak. It involves a Salesforce-hosted platform that holds limited information on its vehicle loan customers. A hacker group has claimed access to sensitive customer and internal records.
The Jaipur-based lender confirmed the investigation. It says its own systems are unaffected and that all banking services are running normally.
Separately, a threat actor has allegedly offered administrator access to electronics retailer Vijay Sales systems for $25,000. Neither the extent of that access nor any data theft has been independently confirmed.
The AU SFB Claim
The cybersecurity tracking account Hackmanac flagged the claim on X. A group calling itself ScarlettGroup said it had breached the lender’s records. It threatened to publish the allegedly stolen data.
The group says the data includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements and insurance records. It also claims customer relationship management (CRM) data, employee information and audit logs. These claims have not been independently verified.
A bank spokesperson told ThePrint that AU SFB is investigating a possible leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce. The platform holds limited data on its vehicle loan customers. The spokesperson said the bank’s own systems remain unaffected and services are normal.
The bank did not confirm whether that platform is the source of the data the group claims to hold. It also did not say how many customers may be affected.
AU SFB partnered with Salesforce in 2024 to digitise onboarding for its vehicle loan customers. At the time, Bhaskar Karkera, head of retail assets at AU SFB, called Salesforce the bank’s partner in digitising those customer journeys.
Salesforce customers have faced attacks before. They involved social engineering and compromised third-party app connections. In one campaign, attackers used voice phishing to trick employees into linking malicious apps to corporate Salesforce accounts. That could expose customer data. But there is no verified evidence that links the AU SFB incident to those campaigns. Nor is there proof that Salesforce’s core platform was compromised.
The Vijay Sales Claim
An actor using the handle “shinymontanna” says it is selling super administrator access to Vijay Sales internal systems for $25,000. The claim comes from a post shared by the X account DarkWeb Informer. Super administrator access usually gives broad control over a system. That includes managing other users and their permissions.
The listing claims access to more than 3 million order records, details on 15,000 employees and billing records for about 1.4 lakh vendors. It also claims customer information, payment and bank transfer records, inventory, financial reports and internal applications. The actor says the access allows viewing, changing and exporting data. Screenshots said to show admin dashboards and super administrator rights have circulated.
The claims remain unverified. There is no independent confirmation of how far the access goes or whether any data was taken.
A Run of Recent Incidents
The reports follow other recent security incidents. SBI flagged the exposure of 3,897 customer records on the dark web. They reportedly included mobile numbers, dates of birth, email addresses and home addresses.
Two critical flaws in PHP, an open-source language widely used to build websites, also came to light. They prompted emergency action from governments and companies worldwide.
Cybersecurity firm eMudhra also announced plans to wind down its global SSL/TLS certificate business after a certificate security incident. A researcher found that the private keys for eight of its intermediate certificate authorities (CAs) could be recovered. These CAs issue the digital certificates that secure website connections. eMudhra said it revoked all eight and that no certificates had been issued from them. It said its infrastructure was not compromised and no data was breached.
