Salesforce States No Platform Vulnerability Found in AU Small Finance Bank Data Leak Probe

Customer relationship management firm Salesforce stated on Saturday that it has not identified any vulnerability at its end regarding a suspected data leak involving its customer, AU Small Finance Bank.

"Based on currently available information, we have not identified a vulnerability in the Salesforce platform related to this issue," Salesforce said in a statement. The company added that, as a matter of policy, it does not comment on specific customer issues, but its teams are engaged to support customers as needed.

The statement follows an announcement made a day prior by AU Small Finance Bank, which reported that it had initiated a probe into a potential data leak affecting its vehicle loans customers. The bank stated that the issue involved a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to vehicle loan customers. AU Small Finance Bank reaffirmed that its own systems remain unaffected and that all banking services are operating normally.

According to threat intelligence platform Hackmanac, a hacker group named The ScarlettGroup claimed to have breached AU Small Finance Bank's cyber defense system and threatened to release sensitive customer and internal corporate data. Hackmanac stated on social media that the attackers claimed to possess KYC records, personal identification documents, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information, login histories, and audit logs. However, Hackmanac noted that verification of these claims is still pending.

The incident occurs amid a series of reported cyberattacks impacting various financial entities in the country, including major institutions like the State Bank of India (SBI) and ICICI Bank. Previously, on October 25, Prime Minister Narendra Modi addressed the issue of cyberattacks aimed at weakening the Indian economy during an event in Bhubaneswar, where he inaugurated the Reserve Bank of India's data centre and Cybersecurity Training Institute, urging all stakeholders to address the security aspect.

"The situation at AU Small Finance Bank highlights the critical importance of shared responsibility models in cloud and SaaS deployments. As financial institutions increasingly rely on third-party platforms for managing customer data, robust vendor risk management and rapid incident response are essential to maintain consumer trust. Businesses must prioritize rigorous security audits across both internal and external infrastructure to mitigate escalating cybersecurity risks in the financial sector." — Dr. Shishir Gupta, Founder & CEO, StartupLanes