AU Small Finance Bank probes ‘potential data leak’ as hackers claim breach on dark web

AU Small Finance Bank is investigating a potential data leak involving a Salesforce-hosted platform containing vehicle loan customer data, the bank told MediaNama in an email response. The investigation follows a claim by a hacking group on the dark web that it had breached the lender. Cyber threat intelligence account Hackmanac first reported the claim on X.

The bank also claims that its own systems are unaffected. Here is the full statement shared with MediaNama:

“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers.

We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.” – AU Small Finance Bank 

MediaNama reviewed the hacking group’s dark web listing, which claims to include Aadhaar and PAN details, credit reports, signed loan agreements and employee records. The claimed scope is far broader than the “limited data” acknowledged by the bank. However, the group has not publicly released any data samples or the complete datasets. At the time of writing, the listing was marked “negotiation” and displayed a countdown of five days and 17 hours. 

MediaNama could not independently verify that the group holds any original data that belongs to AU Small Finance Bank. We are not naming the group or linking to its website to avoid further exploitation of any data that may have leaked.

What the listing describes: The listing categorises the allegedly compromised information as follows, suggesting a broader scope than vehicle loan customer data. We reproduce the description as it appears:

“Customer KYC (Core): Per details (name, DOB, PAN, Aadhaar, contact information, family, address, income, education, risk categorq), photos, signatures, CIF/API payloads, field verification notes, and KYC screening records (CKYC. CFR, ICU).

Credit and Financial Records: CIBIL reports, FICO scores, address checks, bank statements,_Aadhaar tokens, bureau data, applicant financials, loan applications, approvals, collateral, insurance, disbursements, paqment schedules, and account statements.

Signed Loan Documents: e5ign PDFs, loan applications, KFS, sanction letters, MACH mandates, collateral agreements, insurance forms, and supporting ‘documents.”

“CRM Person Records: Customer contacts, accounts, addresses, case notes, queries, assignments, work orders, bureau responses, and stored files (ContentVersion).”

Staff and Internal Identity: Employee directory, contact details, permissions, group memberships, account teams, roles, login history, IF’ addresses, and audit logs.

and much more.” –  Description of alleged hacked data of AU small finance bank. 

The listing also claims employee directories, permissions and audit logs, which the bank has not addressed. The bank’s emphasis on its “own systems” does not answer whether customer data was exposed through a third-party platform. 

This development comes at a time when Indian financial institutions are facing multiple cyberattacks. Read more about these cyberattacks here.

While reviewing this, MediaNama also found that the same hacker group claims to hold data from Rajasthan Police. The group’s listing describes the allegedly compromised Rajasthan Police data as follows:

“witness statements
5,926 Mailboxes
22,686 attachments
68,867 direr-toru records
73,331 identity records
783,435 unique emails
69 verified credentials
21 WPN logins with cleartext. passwords and internal IPs
64 VPN client certificates
13 certificates t.hat. open t.o t.he private key
46 account. ledger entries
6,312 high value t.arget.s
1,1365 tier A senior officer mailboxes”

We are not disclosing the website the group says it took the data from. We cannot confirm whether the vulnerabilities it may have exploited have been fixed. We have emailed Rajasthan Police asking for confirmation and a comment. MediaNama will update this report or publish a follow-up article after receiving a response. 

Also read

• SBI confirms data of 3,897 customers exposed on dark web
• Amagi Media Labs faces extortion attempt, operational data stolen
• CBFC data breach exposed scripts and censor cuts of 500+ films

The post AU Small Finance Bank probes ‘potential data leak’ as hackers claim breach on dark web appeared first on MEDIANAMA.