AU Small Finance Bank Data Breach Claim: 1.2 TB Dump Alleged, Not Verified

Fri Nov 06

November 6, 2026: AU Small Finance Bank, the Jaipur-headquartered small finance bank, is the subject of an unverified underground-forum claim that a threat actor stole 1.2 TB from the bank's own systems — more than a billion records, including KYC files with PAN and Aadhaar numbers — and is offering the dump for $8,500. The bank has said it is investigating a limited leak on a third-party Salesforce SaaS used to onboard vehicle-loan customers, and that its own systems are unaffected. The catalog entry records the forum claim as unverified.

What is known

On October 29, 2026 the bank became aware of a potential data leak involving a Salesforce-hosted SaaS platform used to onboard vehicle-loan customers. It told the stock exchanges on November 2 that about 28.5 lakh (2.85 million) vehicle-loan customers were onboarded through that platform, and that some of those records may have leaked.
The bank says its other systems remain unaffected, services are running, and the matter was reported to the Reserve Bank of India and CERT-In.
Salesforce has said, based on information available to it, that it has not identified a vulnerability in the Salesforce platform related to the issue.
A threat actor later posted on an underground forum claiming a core-system breach, not only the SaaS platform: 1.2 TB, more than a billion records, and a sale price of $8,500. The post lists alleged counts for complete KYC identities (about 3.85 million, with PAN, Aadhaar, dates of birth, mobiles, emails and addresses), live accounts, account numbers, core-banking transactions, credit-bureau dossiers, loan-book files, and scanned agreements and signatures. Sample-file links were offered as proof. Independent researchers have not confirmed that those samples are authentic AU Small Finance Bank data.

What is not known

Whether the forum dump is real, recycled, or inflated. The bank's filing describes a limited third-party platform incident; it does not confirm a 1.2 TB take from core banking systems.
How many vehicle-loan customers were actually leaked from the SaaS platform. 28.5 lakh is the number onboarded through it, not a confirmed leak census.
Whether PAN, Aadhaar, account numbers, CIBIL/FICO files or scanned signatures were in the Salesforce dataset, in the forum dump, in both, or in neither.
Who the actor is, how any access was obtained, and whether any data has been sold or published in full.

Forum sale posts routinely overstate volume. Treat the billion-record figure as marketing until a regulator, the bank or a researcher publishes a matching census. We are not linking to the dump or the samples.

Who is at risk

Vehicle-loan customers of AU Small Finance Bank, especially anyone onboarded through the Salesforce journey the bank named. If the unverified dump were genuine, a much wider set of customers could be exposed to identity theft using PAN and Aadhaar. Even the limited SaaS leak is enough for targeted phishing that quotes a loan or a branch.

What to do

Watch for an official letter or SMS from the bank. Do not trust inbound calls or emails that ask you to "verify Aadhaar", "unlock your account" or move money.
Log in to AU Small Finance Bank only by typing the bank's website or using the official app — not through a link in a message.
If you have a vehicle loan with the bank, check registered mobile, email and linked accounts, and turn on transaction alerts.
Be wary of anyone offering copies of the alleged dump or asking you to pay to "remove" your record.
If you receive a genuine notice, follow the bank's instructions and consider a credit freeze or CIBIL alert.

Sources

Sourcing note: the exchange filing is the only official record of scope. The 1.2 TB / billion-record figures come from an unverified forum post. We will update this post if the bank, RBI or CERT-In publishes a census, or if researchers confirm the samples.