AU Small Finance Bank data breach: Hackers threaten to leak Aadhaar, PAN and customer records

AU Small Finance Bank is investigating a potential data leak after a hacking group identified as ScarlettGroup claimed to have accessed sensitive customer and internal company records. The alleged leak is said to encompass personal and financial data such as Aadhaar and PAN numbers, KYC documents, CIBIL scores, bank statements and loan information. The group has threatened to release the allegedly stolen information if the bank doesn’t negotiate within six days.

The alleged breach was first highlighted by cybersecurity monitoring account H4ckmanac in a post on X on October 30, 2026. ScarlettGroup has published a countdown labelled ‘Negotiation deadline’ and displayed blurred samples of documents. However, the scope of the data leak and the extent to which customers may have been exposed are unclear.

AU Small Finance Bank responds to data leak reports

AU Small Finance Bank has admitted that there may have been a data breach on its Salesforce app, which is a software-as-a-service (SaaS) system that Salesforce manages and hosts. The bank has stated in an official announcement that the platform carries only a small amount of information about its vehicle finance customers.

The bank said, “The matter is under investigation. We would like to reaffirm to all stakeholders that the bank’s systems remain unaffected, and all services are operating normally.”

The alleged incident was not an issue with the bank’s main banking systems, the clarification says. The bank has not revealed how many records might have been exposed or what kind of information was included in the potential breach.

What data do hackers claim to have accessed?

According to the information attributed to ScarlettGroup and reported by cybersecurity monitoring sources, the allegedly compromised records may include:

• Personal details: Aadhaar numbers, PAN details and KYC documents.
• Financial records: CIBIL scores, credit reports, bank statements and loan applications.
• Loan paperwork: Approvals, signed paperwork and security information.
• Insurance and customer records: Insurance documents and customer relationship management (CRM) data.
• Internal company data: Employee directories, login history, IP address and audit logs.

The hackers have said that if the countdown of negotiations is not met, they will release the information. However, these claims have not been independently verified.

What should AU Small Finance Bank customers do?

Customers need to be vigilant against calls, emails and messages appearing to be from the bank that are suspicious. They should not share OTPs, banking passwords, Aadhaar details or other sensitive information with unknown callers.

It’s also important for customers to watch their bank statements and alert their banks to any suspicious activity as soon as it occurs. The investigation is ongoing, and further details about the potential exposure are awaited from AU Small Finance Bank.