AU Small Finance Bank Data Leak Claim: What Happened, What the Bank Says and What Customers Should Know

What happened

On Thursday, 29 October 2026, a hacking group calling itself "ScarlettGroup" claimed it had broken into AU Small Finance Bank and threatened to publish customer and company data. The claim was flagged on X by Hackmanac, an account that tracks cyberattacks.

By Friday, AU Small Finance Bank, the Jaipur-based lender, confirmed it was looking into it. A spokesperson told ThePrint and Moneycontrol that the bank is "investigating a potential data leak" involving a software-as-a-service platform "managed and hosted by Salesforce", which holds "limited data relating to our vehicle loan customers".

The bank added that its own systems remain unaffected and all banking services are running normally.

What the hackers claim, and what is actually confirmed

This is the most important part to get right.

Claimed by the hackers (not verified): KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs. ThePrint said it could not independently verify these claims.

Confirmed by the bank: only that it is probing a potential leak on a third-party platform with limited vehicle-loan data.

Not known yet: whether the hackers' data really came from that platform, how many customers it covers, and whether customers have been contacted. Moneycontrol notes the bank had about 1.22 crore unique customers at the end of FY26, but there is no number for anyone affected.

Why people are searching

Bank data is personal, so any claim like this makes people search fast. The timing also matters. Earlier this month, SBI said a check of about 3.75 lakh records on the dark web found 3,897 SBI customer records with personal information, and Bank of Baroda reported a security incident in July. A third bank story in a few months has people asking how safe their data is.

There was also a market angle: AU SFB shares slipped about 2% on Friday.

Who is ScarlettGroup?

According to ThePrint, citing a 21 October report by cybersecurity firm Foresiet, the group runs a leak site on the Tor network, lists victims and threatens to publish data if negotiations fail. It has made other claims this month, including a claimed breach of Rajasthan Police data, which led Rajasthan Police to start a probe. Again, a claim by a hacking group is not proof of a breach.

What comes next

The next real update will come from the bank: whether data was taken, and who is affected. Until then, the safe habit for every bank customer is the usual one. Never share an OTP, PIN or password with anyone who calls or messages you, even if they know your loan or account details. This is general safety guidance, not financial advice.

We will update this story as official information comes in.