---
title: "AU Small Finance Bank’s possible leak: ‘some’ of 28.5 lakh vehicle-loan customers"
summary: "What AU Small Finance Bank’s 2 November reply to the exchanges says about a possible leak at a vendor-run loan-onboarding platform, what its 28.5 lakh figure means, and the clocks a bank runs."
url: https://www.thetechbag.com/blog/au-small-finance-bank-data-leak-28-lakh-platform
format: Note
desk: "Security"
area: "Threats & vulnerabilities"
region: India
published: 2026-11-04
facts_checked: 2026-11-04
author: TechBag (The TechBag Journal)
tags: ["AU Small Finance Bank","data leak","vehicle loans","Salesforce","SaaS","third-party risk","ScarlettGroup","KYC","CERT-In","RBI","DAKSH","SEBI LODR","DPDP Rules","Yatra Online","BFSI"]
cover: https://www.thetechbag.com/blog/covers/au-small-finance-bank-data-leak-28-lakh-platform.png
---

# AU Small Finance Bank’s possible leak: ‘some’ of 28.5 lakh vehicle-loan customers

*What AU Small Finance Bank’s 2 November reply to the exchanges says about a possible leak at a vendor-run loan-onboarding platform, what its 28.5 lakh figure means, and the clocks a bank runs.*

Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-04 · Facts checked 2026-11-04 · Canonical: https://www.thetechbag.com/blog/au-small-finance-bank-data-leak-28-lakh-platform

AU Small Finance Bank told the stock exchanges on 2 November that on 29 October it learned of a “potential data leakage incident” on a third-party software-as-a-service platform, “hosted and managed by a reputed global third-party vendor”, that it uses to onboard vehicle-loan customers. Preliminary findings: the incident “may have resulted in data leakage of some of the Bank’s vehicle loan customers”. About 28.5 lakh vehicle-loan customers were onboarded through the platform.[1]

**Figure: AU's first exchange filing on the leak came four days after discovery, as a reply to NSE's query**

*AU Small Finance Bank's data-leak disclosures, 29 October to 4 November 2026, times in IST*

| Date | Event | Detail |
| --- | --- | --- |
| 29 Oct 2026 | Bank becomes aware | Date given in the bank's 2 November reply. PTI: Hackmanac posted ScarlettGroup's claim the same Thursday |
| 30 Oct 2026 | Bank names Salesforce as the platform's host | Statement as reported by PTI; shares close 1.76% lower at ₹864 on the BSE |
| 31 Oct 2026 | Salesforce: no flaw found in its platform | Statement to PTI |
| 2 Nov 2026 | 18:08: NSE asks AU to clarify | News item: “AU Bank probes potential data leak” |
| 2 Nov 2026 | 23:55: the reply is filed | Signed 23:46 by the company secretary |
| 4 Nov 2026 | 17:15: NSE re-posts the reply | Same letter, under News Verification |

Source: AU Small Finance Bank reply to the exchanges; NSE announcements; PTI · as of 4 November 2026, 7pm IST

## What the 28.5 lakh is, and is not

It is the number of vehicle-loan customers onboarded through the platform. It is not a count of records leaked or of customers affected; the bank says “some” and is running internal and external forensic work “to ascertain the nature and extent”.[1] The letter gives no start date, no data fields and no vendor name. On 16 September AU said its vehicle-finance business “now serves over 13.7 lakh customers”.[3] Neither document reconciles the two figures, and we do not guess why they differ.

ReportedNot in the filing: PTI's reporting

On 30 October the bank named a “platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers”. A group calling itself ScarlettGroup claims KYC records, PAN and Aadhaar details and credit reports; Hackmanac, the threat-intelligence platform that posted the claim, said verification “is still pending”.[4] On 31 October Salesforce said: “we have not identified a vulnerability in the Salesforce platform related to this issue.”[5]

## Why an onboarding platform is where the data sits

When AU and Salesforce announced the system in April 2024, it was an end-to-end digital onboarding app for relationship officers and business managers, covering underwriting decisions and “data and document verification”, drawing on the bank’s existing API stack.[6] The filing confirms what such a tool holds: “customers’ information obtained at the time of loan onboarding”.[1] What a borrower hands over at onboarding is collected there by design, in a system the vendor hosts; AU says its other systems are unaffected.

How the data left is not known. In the Salesforce thefts of the past year, traced in [our July explainer](https://www.thetechbag.com/blog/shinyhunters-salesforce-oauth-phone-call), attackers did not break the platform: callers talked staff into approving an attacker’s app, and tokens stolen from integrations opened customers’ instances. Microsoft called it “not the result of a vulnerability inherent to Salesforce”.[7] Nothing public links AU’s incident to that campaign.

The defences Microsoft published for that campaign are settings the customer holds in its own tenant: list every connected app and find the highly privileged ones, remove apps idle for 90 days or more, keep the right to approve apps and run exports with a few administrators, and keep the query logs that show a bulk export.[7] They apply to any SaaS tenant that holds identity documents.

The clocks an Indian small finance bank runs

CERT-In: six hours from noticing a data breach or leak.[8] The RBI’s Small Finance Banks Directions of 31 July 2026, paragraph 181: report cyber incidents “within six hours of detection on DAKSH platform” and notify CERT-In.[9] AU says it reported to both; it does not say when. SEBI’s listing rules require a “specific and adequate reply” to an exchange’s query (regulation 30(10)) and put cyber incidents in each quarterly governance report (27(2)(ba)).[10] No binding rule yet requires telling the customers: the DPDP Rules’ notice to each affected person and 72-hour report to the Board start on 13 May 2027.[11] The same night Yatra Online told the exchanges it had “experienced a cyber-security incident” and notified CERT-In; it named no date, systems or data.[12]

How we did this

Figures as of 4 November 2026, 7pm IST

Incident facts are AU’s 2 November letter, read in full; times are NSE’s announcement log.[2] “Four days” is 29 October to 2 November; NSE lists no AU filing on the leak before the query. The 13.7 lakh is AU’s September release. The vendor’s name, its denial and the attackers’ claim are PTI’s reporting, labelled. A separate retailer leak claim reported alongside is left out: no primary source.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [AU Small Finance Bank, Reply to clarification sought by Stock Exchanges (AUSFB/SEC/2026-27/287)](https://nsearchives.nseindia.com/corporate/AUBANK_02112026235324_Clarification_SE.pdf) — 2 November 2026
2. [NSE, AU Small Finance Bank announcements: News Verification (re-attached reply)](https://nsearchives.nseindia.com/corporate/kkurmi_04112026171135_Reply_to_news_clarification.pdf) — 4 November 2026
3. [AU Small Finance Bank, Wheels business crosses ₹50,000 crore AUM](https://www.au.bank.in/pdfs/press-release/2026/Wheels-Milestone-of-crossing-Rs-50000-crore.pdf) — 16 September 2026
4. [PTI via ThePrint, AU Small Finance Bank probing potential data leak of vehicle loan customers](https://theprint.in/economy/au-small-finance-bank-probing-potential-data-leak-of-vehicle-loan-customers/3086435/) — 30 October 2026
5. [PTI via Deccan Chronicle, Salesforce says no vulnerability at its end](https://www.deccanchronicle.com/nation/current-affairs/au-sfb-data-leak-salesforce-says-no-vulnerability-at-its-end-2000549) — 31 October 2026
6. [VARIndia, Salesforce to transform digital onboarding for vehicle loans for AU Small Finance Bank](https://www.varindia.com/news/salesforce-to-transform-digital-customer-onboarding-for-vehicle-loans-for-au-small-finance-bank) — 1 April 2024
7. [Microsoft Security blog, Defending SaaS-based applications against ShinyHunters OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/) — 13 July 2026
8. [CERT-In, Directions under section 70B(6) of the IT Act, Annexure I](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
9. [RBI, Small Finance Banks Cybersecurity Directions, 2026 (RBI/DoS/2026-27/419), para 181](https://rbi.org.in/ScriptS/BS_ViewMasDirections.aspx?id=13634) — 31 July 2026
10. [SEBI, LODR Regulations, 2015 (amended to 22 January 2026), regulations 27(2)(ba) and 30(10)](https://www.sebi.gov.in/sebi_data/attachdocs/jun-2026/1780915347745.pdf) — 22 January 2026
11. [DPDP Rules, 2025, commencement timeline (Rule 7 from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — 13 November 2025
12. [Yatra Online, Regulation 30 intimation of cyber security incident](https://nsearchives.nseindia.com/corporate/YATRA2022_02112026220358_Intimation_of_Cyber_Security_Incident.pdf) — 2 November 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [The phone call that beat MFA: how ShinyHunters got into Salesforce through OAuth](https://www.thetechbag.com/blog/shinyhunters-salesforce-oauth-phone-call) — How a year of SaaS data thefts through Salesforce worked: voice calls, approved apps and stolen integration tokens, from Microsoft, Google and the FBI.

Go deeper on TechBag

- [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the six-hour clocks and the rest of a bank's reporting duties
- [Salesforce vendor hub](https://www.thetechbag.com/salesforce) — the platform the bank named, and its products
- [Identity governance guide](https://www.thetechbag.com/browse/identity-access/identity-governance) — reviews of who and what holds access to a SaaS tenant, connected apps included