AU Small Finance Bank has told the stock exchanges that its probe into a possible data leak covers a third-party software-as-a-service (SaaS) platform holding about 28.5 lakh vehicle loan customers. In a clarification dated 2 November 2026, the Jaipur-based lender said preliminary findings show the incident “may have resulted in data leakage of some” of these borrowers, and that the matter has been reported to the Reserve Bank of India and CERT-In.
The filing puts the first number on an incident the bank first acknowledged on 30 October, when it said only that a SaaS platform with “limited data” on vehicle loan customers was under investigation. Elets BFSI reported then on how the AU SFB leak added to rising bank cyber insurance claims, when the bank had not said how many customers could be affected.
What AU Small Finance Bank told the exchanges
The disclosure came in reply to a clarification sought by NSE and BSE on 2 November over a media report on the incident. The key points from the filing:
- The bank became aware of the potential data leakage on 29 October 2026.
- The affected system is a SaaS platform “hosted and managed by a reputed global third-party vendor” and used to onboard vehicle loan customers. It holds information collected at the time of loan onboarding.
- About 28.5 lakh vehicle loan customers were onboarded through the platform. The bank has not said how many of them were actually exposed.
- A detailed internal and external forensic investigation is under way with leading cyber security firms to establish the nature and extent of the leak.
- The bank’s other systems are unaffected, services are running normally, and there is no impact on business operations, financial performance or business continuity, it said.
The bank said it will make further disclosures if required under regulatory rules.
Why a third-party SaaS platform matters
In its 30 October statement to the media, the bank had named the platform as one managed and hosted by Salesforce. AU SFB had tied up with Salesforce in 2024 to digitise vehicle loan onboarding, its oldest business. The exchange filing does not name the vendor.
A hacking group calling itself ScarlettGroup has claimed the breach and threatened to publish data. Its claims, which include KYC, PAN and Aadhaar details, credit reports and loan agreements, have not been independently verified, and the bank has not confirmed what data fields were exposed.
The case shows how a bank’s risk now extends to the cloud tools its teams use for sales and onboarding, even when core banking stays untouched. CERT-In has repeatedly warned financial institutions about stolen partner credentials and weak API links, and attacks on lenders have climbed this year. Elets BFSI has tracked AI-powered cyberattacks costing small NBFCs an estimated ₹300 crore and the ₹7.8 crore cyber fraud at Spandana Sphoorty.
What it means for borrowers and lenders
For AU SFB’s vehicle loan customers, the practical risk from leaked onboarding data is targeted phishing and impersonation calls, since fraudsters can quote real loan and contact details. Customers should not share OTPs, PINs or card details on calls or messages claiming to be from the bank, and should report suspicious contact through the bank’s official channels or the national cyber crime helpline 1930.
For lenders, the incident adds pressure under India’s data protection regime. The Digital Personal Data Protection Rules, 2025 require data fiduciaries to report personal data breaches and to hold vendors to security obligations, with the main duties applying from May 2027. Banks preparing for those rules, as covered in Elets BFSI’s analysis of DPDP and the AI reckoning in India’s BFSI, will need tighter oversight of SaaS providers that hold customer data.
Key takeaways
- AU Small Finance Bank says its data leak probe covers a SaaS platform holding about 28.5 lakh vehicle loan customers.
- The bank learnt of the incident on 29 October and has reported it to RBI and CERT-In.
- Forensic firms are still working out how many customers and which data were exposed; core systems are unaffected, the bank says.
