Hacker group claims cyber attack on AU Small Finance Bank; bank says core systems are secure

A major cyber attack has reportedly hit AU Small Finance Bank, one of the country's leading private banks. A hacking group has claimed it breached highly sensitive customer and internal data of the bank. The information was shared from the cyber security monitoring account '@H4ckmanac' on X (formerly Twitter).

A hacking group calling itself 'ScarlettGroup' has claimed responsibility for the attack. The group has also threatened to make the stolen data public. The post says the incident was recorded on October 29, 2026, and notes that it is yet to be verified.

According to the social media post, the hackers have leaked highly personal and financial information of the bank's customers and employees. This includes customers' PAN card and Aadhaar card details and other identity documents. The claim also covers bank statements, credit reports, loan applications, customers' signatures and agreements executed. Insurance records and customer relationship management data are also mentioned. The hackers are further said to have taken employee information, login history and internal audit logs.

If the claims prove true, highly confidential information of lakhs of customers could be at risk. Cyber criminals can use such sensitive data for identity theft, financial fraud, fake credit cards and other online scams.

AU Small Finance Bank has given an official response to the matter. The bank has stated that its main servers and internal systems are completely secure. It is conducting a thorough investigation into a possible data leak linked to a software-as-a-service (SaaS) platform run and hosted by Salesforce. The bank said in its statement that this platform holds only limited data relating to its vehicle loan customers.

The bank has also said its own systems are completely secure and have not been affected, and that all banking services are running smoothly as usual.

Against this background, customers of AU Small Finance Bank have been urged to remain extremely vigilant. They should not trust fake calls, SMS messages or emails from people posing as bank officials. They should not share PAN or Aadhaar numbers, banking passwords or OTPs with anyone. They have been advised to monitor their bank account transactions regularly and to contact the bank immediately if they notice any suspicious transaction.