AU Small Finance Bank Investigates Potential Leak; Vijay Sales Systems Allegedly Offered for Sale

AU Small Finance Bank is reportedly examining a potential data leak involving a third-party platform, while Vijay Sales faces claims that an attacker has gained access to its internal systems. The incidents involve potentially sensitive customer and business information, including financial records and employee data. While the bank has confirmed an ongoing investigation, the claims surrounding Vijay Sales stem from a dark web listing. Neither incident has been independently verified, and the full extent of any data exposure remains unknown.

AU Small Finance Bank Probes Possible Data Leak

AU Small Finance Bank is investigating a possible data leak involving a Salesforce-hosted platform that holds limited information about its vehicle loan customers, Business Standard reported. The lender is said to have claimed that its own systems remain unaffected and banking services continue to operate normally.

The investigation reportedly follows allegations by hacking group ScarlettGroup that it accessed customer and internal corporate data. According to HackRisk, the group has threatened to release the information. The data it claims to have obtained includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements, the report added. Insurance records, customer relationship management data, employee information and internal audit logs are also said to be among the allegedly accessed records.

The bank has not confirmed whether the platform under investigation is linked to ScarlettGroup's claims, according to the report. It has also reportedly not disclosed how many customers, if any, may have been affected.

Vijay Sales Systems Allegedly Offered for $25,000

In a separate incident, Dark Web Informer claimed that a threat actor using the handle shinymontanna is offering alleged access to Vijay Sales' internal systems for $25,000 (roughly Rs. 23,73,600). According to the listing, the access could expose more than 3 million order records, information on around 15,000 employees and billing records for approximately 1,40,000 vendors.

The listing is also said to claim access to customer details, payment records, bank transfers, inventory data, financial reports and internal applications. The seller says the access allows them to view, modify and export data, and has shared screenshots purportedly showing administrative dashboards and elevated permissions. However, these claims have not been independently verified, and it is unclear whether any data has been accessed or extracted.

It is not yet clear whether the seller has genuine access to Vijay Sales' systems or has stolen any data, and the claims remain unverified.