Cybercriminals are increasingly turning their focus toward sensitive customer information stored within the banking ecosystem alongside traditional monetary assets. Shortly after dark web monitors revealed exposed records connected to customers of State Bank of India, fresh cybersecurity concerns have surfaced around AU Small Finance Bank. A threat actor syndicate has claimed responsibility for breaching systems containing customer records, prompting the private lender to initiate an immediate technical inquiry. The financial institution maintains that its core banking infrastructure remains fully protected and that regular client transactions continue without interruption.
Inquiry into Salesforce Platform and the Bank's Position
AU Small Finance Bank stated on Friday that it is actively investigating a suspected data security incident tied to a third-party software platform hosted on Salesforce. According to the institution, this specific digital application maintains a limited repository of information related exclusively to vehicle loan borrowers. The bank emphasized that the environment in question is managed and hosted directly by Salesforce, separating it from the primary banking architecture. Management clarified that its core systems were not breached, ensuring that regular teller, online, and automated transaction services continue to function in their standard operational manner.
Claims by Hacker Group Over Sensitive Customer Files
A threat collective operating under the moniker ScarletGroup claimed responsibility for infiltrating the bank's digital perimeter. The group asserts that it acquired an extensive cache of sensitive records belonging to both customers and internal operations. According to their published assertions, the compromised data contains Know Your Customer verification files, identity credentials including PAN and Aadhaar details, credit reports, bank account statements, original loan applications, executed agreements, and associated insurance documents. The collective also claimed to possess customer relationship management data, corporate employee profiles, system login logs, and internal audit histories. Independent cybersecurity researchers have not yet confirmed the authenticity of this exfiltrated data, and the bank continues its technical probe into the alleged breach.
Previous Exposure of 3,897 State Bank of India Customer Records
This incident comes on the heels of a cybersecurity disclosure in October involving State Bank of India, where private data belonging to 3,897 customers appeared on the dark web. That leak exposed personal records comprising registered mobile numbers, dates of birth, email addresses, and residential locations. State Bank of India officially confirmed the occurrence of that cybersecurity incident on October 21. That disclosure followed high-priority security warnings delivered to the country's largest public lender by its threat intelligence service partner, the Defence Cyber Agency, and India's national cyber emergency agency, CERT-In.
Risks of Identity Theft and Safeguards for Banking Customers
When sensitive identifying documents fall into the hands of criminal networks, the records are frequently weaponized to execute targeted phishing campaigns, orchestrate identity theft, and coordinate unauthorized banking transfers. Account holders must remain vigilant against potential social engineering scams and verify unsolicited communications. Individuals should never disclose sensitive authentication factors, such as one-time passwords, personal identification numbers, security tokens, or net-banking login credentials over phone calls or electronic messages. Furthermore, customers must refrain from opening unverified hyperlinks transmitted through unexpected text messages or electronic mail.
