Representative image. Jan Bockaert, CC BY-SA 2.0, Wikimedia Commons
.jpg){kind=link}
Why it matters
Loan and identity details are what make scam calls sound real. If any AU Small Finance Bank customer data is out, fraudsters can quote real loan numbers and EMIs to win trust. RBI rules make the speed of reporting a fraud decide how much of a loss the customer bears.
AU Small Finance Bank said on 30 October 2026 that it is investigating a potential data leak involving a software platform run and hosted by Salesforce, which holds limited data on its vehicle loan customers. The AU Bank data leak probe began after a hacking group calling itself ScarlettGroup claimed it had broken into the lender and threatened to publish customer records. The bank said its own systems were not affected and all banking services were running normally.
What AU Small Finance Bank has said so far
The bank’s statement was short. A spokesperson gave it to Moneycontrol in reply to questions, and the news agency IANS carried the same wording as a statement from the bank. It makes three points: the possible leak is on a software-as-a-service (SaaS) platform, meaning software the bank rents and uses over the internet rather than runs itself; Salesforce manages and hosts that platform; and the data on it is limited and relates to vehicle loan customers.
The statements quoted did not say how many customers are on that platform, what kind of details it holds, or whether the hacking group’s files came from it. Moneycontrol reported that it was not known how many customers had been affected or whether the bank had contacted them. The bank had 12.2 million unique customers at the end of 2025-26, Moneycontrol said, citing the lender’s annual report.
The bank is listed on both exchanges. When NewsPlainly checked the National Stock Exchange’s list of the bank’s announcements on the afternoon of 30 October, it showed no filing about the incident; the latest item was an investor call transcript filed on 28 October.
Shares of the lender fell after the reports. Moneycontrol said the stock was at ₹865.7 on the NSE at 1.27 pm, down 1.7%, and IANS reported it about 2% lower at ₹860.45 on the BSE.
What the hackers claim in the AU Bank data leak, and what is not confirmed
ScarlettGroup’s claim is far broader than the bank’s statement. According to IANS, the group said it had obtained KYC (know your customer) records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, and internal data such as employee details, login histories and audit logs. Moneycontrol reported a similar list from Hackmanac, a cybersecurity monitoring platform, which described the cache in a post on X.
None of this has been confirmed by the bank. Its statement speaks only of limited vehicle loan data on one outside platform, and says the bank’s own systems are safe. Until the bank or an investigator says what was taken, the list above remains the hackers’ claim.
What AU Bank vehicle loan customers can do now
Leaked loan and identity details can make a scam call or message sound genuine, because it can quote real facts: your loan account, your EMI (monthly instalment) amount, your vehicle number. A caller who knows these is not proof that the call is from the bank. Three steps help.
1. Treat every unexpected call or message about your loan with suspicion. Do not share an OTP, PIN, password or card number, do not install an app a caller asks you to, and do not click payment links for “pending EMIs” or “loan closure”. Call the bank back on the number printed on its official website or your loan papers.
2. Check your accounts and credit report. Look through your bank statements for payments you do not recognise, and check your credit report for any loan or card you do not recognise.
3. Report fast if money goes missing. Under the RBI’s rules on unauthorised electronic banking transactions, which also apply to small finance banks, the time you take to tell your bank decides how much of the loss you carry when the breach was neither your fault nor the bank’s.
| When you tell the bank (after its alert) | Your liability, third-party breach |
|---|---|
| Within 3 working days | Zero |
| 4 to 7 working days | Limited to a capped amount or the transaction value, whichever is lower |
| After 7 working days | As per the bank’s board-approved policy |
The same rules say the bank must credit the disputed amount to the account within 10 working days of being told, and settle the complaint within 90 days. For money lost to online fraud, the national cybercrime helpline is 1930, and complaints can also be filed at cybercrime.gov.in.
How to complain to the bank and the RBI Ombudsman
Complain to AU Small Finance Bank first, in writing, and keep the complaint number. If the bank does not reply within 30 days, or you are not satisfied with its answer, you can go to the RBI Ombudsman under the Reserve Bank Integrated Ombudsman Scheme, 2026, which replaced the 2021 scheme from 1 July 2026.
According to the RBI’s frequently asked questions on the scheme, the complaint must reach the Ombudsman within 90 days of that 30-day period ending or of the bank’s last reply, whichever is later. It can be filed online at cms.rbi.org.in or by email to crpc@rbi.org.in, there is no fee, and the toll-free number 14448 gives help and complaint status.
RBI’s push on bank cyber-readiness
The AU Bank data leak probe comes in a month of incidents at Indian lenders. State Bank of India said on 21 October that it had found 3,897 customer records with personal details among data exposed on the dark web, as NewsPlainly reported then.
Reuters reported on 30 October that the RBI has asked banks, in a series of recent meetings, to show proof that they follow its existing cybersecurity rules and to explain how ready they are for risks from artificial intelligence (AI). The central bank also asked banks to check weaknesses in their APIs (application programming interfaces), the software links that connect banks with fintech firms and non-bank lenders, three people familiar with the matter told the agency.
One of them told Reuters that hackers see smaller lenders, non-bank lenders and their outside vendors as “softer targets”. Reuters also cited a police complaint saying two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised transfers from accounts at ICICI Bank on 8 and 9 October, after hackers compromised an API link.
What is still unknown about the AU Bank data leak
The bank’s statement, as quoted by Moneycontrol and IANS on 30 October, did not say how many vehicle loan customers’ records sat on the Salesforce-hosted platform, what fields they contained, or whether customers will be told individually. Nor did it say whether the matter has been reported to CERT-In, India’s cybersecurity agency, or to the RBI. Customers who want an answer on their own account can ask the bank directly through its official channels.
Frequently asked questions
Is my AU Small Finance Bank account safe?
The bank said on 30 October 2026 that its own systems were unaffected and all banking services were running normally. The probe concerns a Salesforce-hosted platform with limited vehicle loan customer data.
What data does ScarlettGroup claim to have?
According to IANS, the group claimed KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and internal records. The bank has not confirmed these claims.
How do I complain to the RBI Ombudsman?
Complain to the bank first. If it does not reply in 30 days or you are not satisfied, file at cms.rbi.org.in or crpc@rbi.org.in within 90 days. There is no fee; help is on 14448.
What should I do if money is taken from my account?
Tell the bank at once: under RBI rules, reporting within 3 working days of its alert means zero liability for a third-party breach. Also call the cybercrime helpline 1930.