AU Small Finance Bank’s possible leak: ‘some’ of 28.5 lakh vehicle-loan customers

01What the 28.5 lakh is, and is not

It is the number of vehicle-loan customers onboarded through the platform. It is not a count of records leaked or of customers affected; the bank says “some” and is running internal and external forensic work “to ascertain the nature and extent”.¹ The letter gives no start date, no data fields and no vendor name. On 16 September AU said its vehicle-finance business “now serves over 13.7 lakh customers”.³ Neither document reconciles the two figures, and we do not guess why they differ.

02Why an onboarding platform is where the data sits

When AU and Salesforce announced the system in April 2024, it was an end-to-end digital onboarding app for relationship officers and business managers, covering underwriting decisions and “data and document verification”, drawing on the bank’s existing API stack.⁶ The filing confirms what such a tool holds: “customers’ information obtained at the time of loan onboarding”.¹ What a borrower hands over at onboarding is collected there by design, in a system the vendor hosts; AU says its other systems are unaffected.

How the data left is not known. In the Salesforce thefts of the past year, traced in our July explainer, attackers did not break the platform: callers talked staff into approving an attacker’s app, and tokens stolen from integrations opened customers’ instances. Microsoft called it “not the result of a vulnerability inherent to Salesforce”.⁷ Nothing public links AU’s incident to that campaign.

The defences Microsoft published for that campaign are settings the customer holds in its own tenant: list every connected app and find the highly privileged ones, remove apps idle for 90 days or more, keep the right to approve apps and run exports with a few administrators, and keep the query logs that show a bulk export.⁷ They apply to any SaaS tenant that holds identity documents.