AU Small Finance Bank is investigating a potential data breach involving vehicle loan customer information held on a Salesforce-hosted platform.
AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers,
The bank assured customers its internal infrastructure wasn't compromised. All banking services continue to operate without interruption, it stated.
We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.
A post about the investigation was flagged by Hackmanac, a cybersecurity account that tracks incidents on X. ScarlettGroup said it had breached the lender's records and threatened to publish the information it allegedly took unless its demands were met.
ScarlettGroup said the information it obtained included Know Your Customer (KYC) records, Permanent Account Number (PAN) details, Aadhaar information, loan applications, credit reports, insurance records, bank statements, and signed agreements.
The hackers said they had accessed customer relationship management (CRM) data and held employee information and audit logs from the bank's systems.
Bank vs Hacker Claims
Bank Statement
Limited Scope
- Investigating potential leak
- Data held on Salesforce SaaS platform
- Limited data relating to vehicle loan customers
- Core systems unaffected
Hacker Claims
Extensive Records
- KYC records including PAN and Aadhaar
- Credit reports and bank statements
- Signed loan agreements and insurance records
- CRM data, employee info and audit logs
MediaNama reviewed the hacking group's dark web listing, which divides the allegedly compromised information into several groups. The categories suggest the group claims to have obtained much more data than the bank acknowledged.
These categories include Customer KYC (Core), Credit and Financial Records, Signed Loan Documents, CRM Person Records, and Staff and Internal Identity.
Customer KYC (Core): Per details (name, DOB, PAN, Aadhaar, contact information, family, address, income, education, risk categorq), photos, signatures, CIF/API payloads, field verification notes, and KYC screening records (CKYC. CFR, ICU).
Credit and Financial Records: CIBIL reports, FICO scores, address checks, bank statements,_Aadhaar tokens, bureau data, applicant financials, loan applications, approvals, collateral, insurance, disbursements, paqment schedules, and account statements.
AU Small Finance Bank worked with Salesforce in 2024 to digitise vehicle-loan customer onboarding and improve the customer journey. Salesforce was helping the bank digitise customer journeys for vehicle loans, said Bhaskar Karkera, who led retail assets at AU SFB.
Cyberattacks targeting Salesforce customers have featured social engineering, including incidents involving connections to third-party applications. In one campaign, attackers posed as callers to persuade employees to link harmful apps with their company's Salesforce accounts.
No verified evidence connects those earlier campaigns with the AU SFB incident. Nor does evidence show that Salesforce's core platform was compromised.
The bank didn't say whether the data the group claims to possess came from a platform hosted by Salesforce. It gave no figure for how many customers may have been affected.
The bank's comments about its own systems leave open whether a third-party platform exposed customer data, MediaNama noted. The group hasn't made data samples or the full datasets public.
At the time of writing, the listing's status read negotiation, with five days and 17 hours left on its countdown. MediaNama couldn't independently verify whether the group possesses original data belonging to AU Small Finance Bank.
MediaNama also found a separate claim by the hacker group that it possesses Rajasthan Police data. It has emailed Rajasthan Police requesting confirmation and comment.
A threat actor made a separate claim, offering administrator access to the systems of electronics retailer Vijay Sales for $25,000. The X account DarkWeb Informer shared a post making the claim from an actor using the handle shinymontanna.
The Vijay Sales listing says it includes records for more than 3 Mn orders, details about 15,000 employees, and billing information for approximately 1.4 Lakh vendors.
A super administrator can generally exercise wide-ranging system control, including managing users and setting their permissions. The actor said the access includes internal applications, customer information, inventory, financial reports, and payment and bank transfer records.
Screenshots said to show administrative dashboards and super administrator privileges have circulated, but the allegations haven't been independently verified. It's unclear how much access was obtained or whether anyone extracted customer or corporate information.
Vijay Sales did not respond to queries on the matter.
Earlier this month, State Bank of India flagged 3,897 customer records exposed on the dark web. The SBI data reportedly contained personal details, including residential addresses, email addresses, dates of birth, and mobile numbers.
After a certificate security incident, cybersecurity company eMudhra said it would wind down its global business in secure sockets layer and transport layer security certificates. A researcher found that private keys associated with eight of eMudhra's intermediate certificate authorities could be recovered.
eMudhra said it had revoked all eight affected intermediates, issued no certificates from them, and suffered no compromise of its infrastructure or breach of data.
- 2024Partnership begins
AU SFB partners with Salesforce to digitise vehicle loan onboarding.
- RecentHackmanac flags post
Cybersecurity account flags ScarlettGroup claim on X.
- CurrentNegotiation status
Listing marked for negotiation with a countdown of five days and 17 hours.
What we know
- AU Small Finance Bank is investigating a potential leak.
- The bank says its core systems are unaffected.
Still unclear
- Whether the Salesforce-hosted platform was the source of the data.
- How many customers may have been affected.
- Whether the group holds any original data belonging to AU Small Finance Bank.
- The extent of the alleged access to Vijay Sales' systems.
