Published: October 31, 2026
StartupFeed Quick Take
- Shares of AU Small Finance Bank fell 1.76% to Rs 864 on October 30 as it probed a Salesforce-linked data leak.
- A seller listed super-admin access to Vijay Sales for $25,000, claiming data on 15,000 staff and 3 million orders (unverified).
- State Bank of India confirmed 3,897 leaked records on October 21; India’s CERT-In rule gives firms 6 hours to report a breach.
Jaipur-based AU Small Finance Bank said on October 30 it is investigating a possible data leak on a Salesforce-hosted platform holding vehicle loan customer records.
The claim is far bigger than the bank’s words. A group calling itself ScarlettGroup, flagged by the threat-intel account Hackmanac, says it took PAN, Aadhaar and loan files. “Limited” is the bank’s own word for it.
A second claim landed the same week. In a post from the account DarkWeb Informer, a seller named “shinymontanna” listed super-admin access to Vijay Sales for $25,000. The post claims more than 3 million order records.
What AU Small Finance Bank has confirmed
AU Small Finance Bank has confirmed only that it is investigating, and that the data sits on a cloud platform run by Salesforce. The bank says the platform holds limited vehicle loan customer data. No count of affected customers has been given.
The lender’s own systems are untouched and services are running normally. AU Small Finance Bank has used Salesforce since 2024 to handle vehicle loan onboarding. So the vendor’s platform, not the bank’s core, is the part under scrutiny.
The bank’s shares closed 1.76% lower at Rs 864 on the BSE on October 30. In a short statement that day, the bank set out its position:
“The Bank’s own systems remain unaffected and all banking services are operating normally.”
AU Small Finance Bank. From the bank’s statement, October 30, 2026.
The hackers’ claim and the Salesforce weak point
ScarlettGroup’s list goes far beyond vehicle loan data. It names KYC (identity) records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements. The group also lists insurance records, customer relationship records, employee details, login histories and audit logs.
The group runs a leak site on the Tor network. Its method has three stages: a public listing, a negotiation window, then release. Trackers logged its claim on the bank’s domain on October 29.
None of this is proven, and the bank has released no data sample. Salesforce customers worldwide were hit through 2026 by voice-phishing calls that tricked staff into linking harmful apps.
The group ShinyHunters ran many of those calls. No evidence yet ties that pattern to AU Small Finance Bank.
The Vijay Sales listing and a month of claims
The Vijay Sales listing offers “super administrator” access to the retailer’s systems. In plain terms, that is near-total control. It lets a user read, change and export data, and manage other accounts.
A seller claims more than 3 million order records and data on 15,000 employees. The post also claims billing records for about 1.4 lakh vendors. Vijay Sales, a Mumbai retailer founded in 1967, has not responded.
These two claims are part of a wider run. On October 21, State Bank of India told the stock exchanges that a review of about 375,000 dark-web records found 3,897 with customer personal data. The bank said the leak did not affect its core systems.
The common thread across these cases is a third-party system, not the bank’s core. Here is how the three October claims compare.
| Organisation | What was claimed or found | What the company confirmed |
|---|---|---|
| AU Small Finance Bank | Identity, PAN, Aadhaar and loan files, per ScarlettGroup | Investigating a leak on a Salesforce platform; own systems unaffected |
| Vijay Sales | Super-admin access for $25,000; 3 million orders, 15,000 staff, 1.4 lakh vendors | No public response |
| State Bank of India | About 375,000 records on the dark web | 3,897 records held customer personal data; core systems unaffected |
What Indian companies and customers should do now
Indian firms that run customer data on outside software must treat vendor access as their own risk. CERT-In, India’s cyber-incident agency, gives a company 6 hours to report a breach once noticed. Missing that window can draw a fine of up to Rs 1 lakh.
Listed companies carry a second duty. A breach that is material must be disclosed to the stock exchanges, as State Bank of India did on October 21.
For customers, the steps are simple. Do not share one-time passwords, PAN numbers or card details with anyone who calls. Watch loan and bank accounts for entries you did not make.
The bigger lesson is old and simple. Your weakest vendor is now your weakest link.
What this means for you: If you hold an AU Small Finance Bank vehicle loan or shop at Vijay Sales, treat any call seeking your OTP or card details as suspect. Do not share one-time passwords, and if you run on outside cloud software, India’s rules give you 6 hours to report a breach to CERT-In.
StartupFeed Insight
The gap in this story is the gap that matters. AU Small Finance Bank admits only limited vehicle loan data; the attackers claim PAN, Aadhaar and full loan files. Three listed names, this bank, SBI and now a retailer, have faced dark-web claims in two weeks. The common thread is a third-party system, not a core bank network. Watch mid-sized lenders next, as their vendor security is thinner than a large bank’s. Expect at least one more Indian financial brand to confirm a vendor-linked leak before December 2026. Also expect RBI to press banks on who holds admin access.
By Avinash Mishra, Business Correspondent
Have a tip? Write to us at editorial@startupfeed.in.
Liked this story? Follow StartupFeed on Google so our reporting reaches you first.
