The threat actor claimed to have obtained customer and internal corporate data, including KYC records, personal identification documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories and audit logs.
Mumbai: AU Small Finance Bank on Friday said that it is investigating a potential data leak involving a software-as-a-service platform hosted by Salesforce after a hacker group claimed to have breached the lender’s systems and accessed sensitive information of vehicle ​loan customers.
In a statement, the bank said it is examining a possible data leak related to a Salesforce-managed platform that contains limited data pertaining to vehicle loan customers.
“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers,” according to the bank’s statement.
However, the lender’s own systems have not been impacted and all banking services continue to operate normally, it added.
“We reaffirm that the bank’s own systems remain unaffected and all banking services are operating normally,” the bank said.
The development comes after reports that hacking group ScarlettGroup claimed responsibility for an alleged breach at AU Small Finance Bank.
According to them, the threat actor claimed to have obtained customer and internal corporate data, including KYC records, personal identification documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories and audit logs.
Following this, shares of AU Small Finance Bank on Friday traded about 2 per cent lower at Rs 860.45 apiece on the BSE. The stock has recorded a 52-week high of Rs 1,144.65 and a 52-week low of Rs 832, as per the exchange data.
Earlier in October, state-owned State Bank of India (SBI) experienced a data breach with 3,897 customer records found exposed on the dark web.
The PSU bank had received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In regarding an alert concerning suspected exposure of customer data.