New Delhi [India], October 30 (ANI): AU Small Finance Bank on Friday said it is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which contains limited information relating to its vehicle loan customers, while maintaining that its own systems remain unaffected and all banking services are operating normally.
In an official response to ANI, the lender said, “AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers. We reaffirm that the Bank’s own systems remain unaffected, and all banking services are operating normally.”
The clarification comes amid reports of a possible cybersecurity incident involving the private sector lender, after a hacker group claimed to have breached the bank and threatened to release sensitive customer and internal corporate information.
The exposed information reportedly included Know Your Customer (KYC) documents, Permanent Account Number (PAN) and Aadhaar details, bank statements, credit reports, loan applications and agreements, along with internal corporate information such as employee records, customer relationship management (CRM) data, login histories and audit logs.
However, the reported exposure has not been independently verified, and the bank has not confirmed that these categories of information were compromised.
The bank's statement identifies a Salesforce-hosted third-party platform containing limited vehicle loan customer data as the subject of its investigation, while distinguishing the potential incident from its own banking systems.
The exact extent of any potential data exposure, the number of customers who may have been affected and whether any information has been misused remain unclear.
The development comes amid heightened concerns over cybersecurity and customer data protection in India's banking sector, following a separate incident involving State Bank of India (SBI) earlier this month.
On October 21, SBI said it had identified 3,897 customer records containing personally identifiable information (PII) during a preliminary analysis of approximately 3.75 lakh records suspected to have been exposed on the dark web.
In an exchange filing, the public sector lender said it had received communications on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In regarding the suspected data exposure.
The exposed information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, along with branch and Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
The incidents have brought renewed attention to the protection of customer information, including data maintained on third-party technology platforms used by financial institutions. (ANI)
AU Small Finance Bank probes potential customer data leak, says banking systems unaffected
