AU Small Finance Bank is investigating a data security claim on a third-party Salesforce platform used for vehicle loans. The lender stated its core banking system remains safe. Shares fell 1.6% following the news.
AU Small Finance Bank is currently investigating a potential data security breach following claims by a hacker group known as ScarlettGroup. The group alleged that it had gained access to sensitive records, including loan agreements and customer data. In response, the bank stated that the issue is limited to a third-party software platform provided by Salesforce, which houses specific information related to vehicle loan customers.
The lender emphasized that its core banking infrastructure, which handles the vast majority of financial transactions and customer accounts, remains secure and unaffected. The bank confirmed that all its banking operations are continuing normally for all customers.
In market reaction, shares of AU Small Finance Bank fell 1.6% to trade at Rs 866.80. For investors, this event highlights the complexities of modern digital banking, where financial institutions often rely on third-party service providers for software and data management. While these platforms help in operational efficiency, they also introduce risks that banks must manage to protect customer privacy.
This incident contributes to a broader trend of cybersecurity concerns across the Indian banking sector. Recent months have seen similar data-related challenges at other large financial institutions, including the State Bank of India and the Bank of Baroda. These events have drawn attention to the persistent difficulty of securing digital ecosystems against unauthorized access.
As of the end of fiscal year 2026, the bank maintained a customer base of 12.2 million unique accounts. While the bank has not confirmed the full extent of the data involved, the incident serves as a reminder of the importance of cybersecurity oversight. Shareholders may monitor future exchange filings for any updates from the company regarding the extent of the impact, steps taken to secure the third-party connection, and whether regulators issue any specific directives regarding data protection standards for outsourced digital systems.