A hacking group listed alleged AU Small Finance Bank data for sale on the dark web on October 31, 2026. The bank confirmed it is investigating “a potential data leak” involving a Salesforce-hosted SaaS platform containing vehicle loan customer data. The bank says its own systems are unaffected. However, the dark web listing claims far broader data including Aadhaar numbers, PAN details, CIBIL reports, signed loan documents, employee records, and internal audit logs. The listing was in “negotiation” mode with a five-day countdown at time of writing. No data samples have been publicly released and no claims have been independently verified.
What the Bank Said
The bank’s statement, shared with MediaNama, is short and specific.
“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers. We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.”
Two things stand out. First: the bank confirmed a Salesforce-hosted platform is involved , this is a third-party vendor, not AU SFB’s core banking infrastructure. Second: the bank used the phrase “limited data” to describe what’s in scope. That characterisation will need to be tested against what the hacking group is actually claiming.
What the Hackers Claim and Why It’s Far Bigger
MediaNama reviewed the dark web listing. The gap between “limited vehicle loan data” and what the group describes is significant.
The listing categorises allegedly compromised data across five areas. Customer KYC records are described as including names, dates of birth, PAN numbers, Aadhaar numbers, contact details, family information, home addresses, income data, education records, risk categories, photographs, and signatures. It also lists field verification notes and records from CKYC , the Central KYC Registry.
The financial records category is even more detailed. The group claims to hold CIBIL reports, FICO scores, bank statements, Aadhaar tokens, loan applications, approvals, collateral documentation, insurance records, payment schedules, and account statements.
Signed loan documents are also listed: eSign PDFs, sanction letters, NACH mandates, KFS documentation, collateral agreements, and insurance forms.
The CRM category includes customer contact records, case notes, work orders, and bureau responses. And then , the part the bank has not directly addressed , the group also claims employee directory data, staff permissions, login histories, IP addresses, and internal audit logs.
This is not the profile of a “limited data” SaaS exposure tied only to vehicle loan customers. If any portion of this is real, it represents a comprehensive breach of customer KYC and financial profile data.
The Third-Party Platform Problem
AU SFB’s framing that its “own systems remain unaffected” is technically accurate but misses the point for customers.
What matters for someone whose Aadhaar number and CIBIL report is allegedly in this dataset is not whether AU SFB’s banking infrastructure was penetrated. It’s whether their data , data they gave to AU SFB to get a loan , is now in criminal hands.
The Salesforce-hosted platform is a third-party SaaS tool. Data held on third-party platforms is still the bank’s data, even if the bank’s own servers were never touched. This is the same structural problem we’ve covered repeatedly through 2026 , the most damaging breaches increasingly don’t come from direct attacks on the organisation but from the vendors, platforms, and tools that sit in the supply chain around it. As we’ve documented in our analysis of how supply chain attacks surface on the dark web before public disclosure, third-party platforms are specifically where attackers find the path of least resistance.
The pattern is identical to the Bank of Baroda breach earlier this year, where an employee email compromise, rather than a core banking system attack, gave a ransomware group access to KYC records, loan documents, and employee data , exactly the categories alleged here.
The Rajasthan Police Connection
While reviewing the listing, MediaNama found that the same hacking group claims to hold data from Rajasthan Police as well.
The alleged police dataset, as described in the listing, includes 5,926 mailboxes, 783,435 unique email addresses, 68,867 directory records, 69 verified credentials, 21 VPN logins complete with cleartext passwords and internal IP addresses, 64 VPN client certificates, and over 6,300 classified as high-value targets. The listing also claims 1,365 tier-A senior officer mailboxes were accessed.
MediaNama has not disclosed the platform the group claims as the source, because it is unclear whether the vulnerability used to access it has been fixed. If correct, this is a materially different attack than what affected AU SFB , VPN credentials with cleartext passwords and internal IP addresses represent live operational access, not a historical data export.
Whether the AU SFB claim and the Rajasthan Police claim use the same methodology or exploit related vulnerabilities is not publicly known. The connection to a law enforcement target in Rajasthan , where AU SFB is headquartered , may or may not be coincidental.
The Aadhaar Problem That Can’t Be Fixed
If Aadhaar numbers are in this dataset, affected customers face a risk that AU SFB cannot remediate for them. Unlike a bank account number or a credit card, Aadhaar is biometric and permanent. You cannot change it.
This is the same issue that made the Bank of Baroda KYC exposure particularly serious , Aadhaar combined with PAN, CIBIL data, and address records creates a near-complete profile for identity fraud Fraudsters with access to this combination can impersonate borrowers, apply for new credit in their names, or construct the kind of synthetic identity profiles that now sell for as little as $200 on dark web markets.
CIBIL reports are specifically valuable because they contain not just a credit score but a detailed history of every loan, credit card, and inquiry associated with a person. That’s the targeting profile a fraudster needs to craft a convincing impersonation.
What Should AU SFB Customers Do Right Now
The bank has not confirmed the scope and no data samples have been publicly released. But the combination of an active dark web listing, a confirmed investigation, and the specific data categories alleged means vehicle loan customers of AU Small Finance Bank should act now rather than waiting.
Lock your Aadhaar biometric authentication. Go to myaadhaar.uidai.gov.in and lock your biometric. This prevents fingerprint and iris-based authentication from working without your deliberate unlock. It doesn’t protect your Aadhaar number from being visible in a dataset, but it limits what someone can do with it.
Watch your CIBIL report closely. If your CIBIL report is in criminal hands, new credit applications in your name are the first risk. Check your score at cibil.com and set up alerts for any new enquiries.
Be suspicious of any AU SFB-related inbound contact. If someone already knows your loan number, Aadhaar number, or payment schedule, they may have accessed this data. AU SFB will never call you to ask for passwords or request you to verify your Aadhaar or PAN over the phone.
Report any suspicious activity to India’s national cybercrime helpline at 1930 or at cybercrime.gov.in. If you believe your financial data has been misused, CERT-In can be reached at cert-in.org.in.
For a full step-by-step guide on what to do when your personal data may be circulating online, our dark web data exposure guide covers the complete response checklist.
Frequently Asked Questions
Has AU Small Finance Bank confirmed a data breach?
The bank confirmed it is “investigating a potential data leak” involving a Salesforce-hosted SaaS platform with vehicle loan data. It has not confirmed a breach and says its own systems are unaffected.
What data did the hackers claim to have?
Aadhaar numbers, PAN details, CIBIL reports, signed loan documents, bank statements, employee directories, VPN access data, and audit logs , far broader than the “limited data” the bank described.
Was the breach of AU SFB’s own systems?
Not according to the bank. The platform implicated is a Salesforce-hosted third-party SaaS tool. However, data held on third-party platforms is still customers’ data and customers’ risk.
Is the data confirmed to be genuine?
No. MediaNama reviewed the listing but could not independently verify the claims. No sample data has been publicly released by the group.
What should AU SFB customers do?
Lock Aadhaar biometric authentication, monitor CIBIL reports, be suspicious of inbound contact referencing personal loan details, and report any fraud to cybercrime.gov.in or call 1930.