AU Small Finance Bank says a third-party software platform it uses to onboard vehicle loan customers may have leaked data of some of those customers, and that its own banking systems are unaffected. If you have, or applied for, a vehicle loan with AU Bank, assume your loan details could be in criminals' hands: treat unexpected calls and messages about your loan with suspicion, never share an OTP, PIN or CVV, check your credit report, and report fraud on 1930 or cybercrime.gov.in.
Who this guide is for
This guide is for AU Small Finance Bank customers, especially vehicle loan customers, and for family members who help them with banking. It separates what the bank has officially said from what hacker groups claim, then gives practical steps. EpiFive is not affiliated with AU Bank; the official bank statements and contact numbers are linked so you can check them yourself.
What happened
These are the facts as the bank and named sources have stated them, in date order.
- 29 October 2026: the bank says it became aware of "a potential data leakage incident involving a third-party Software-as-a-Service ("SAAS") platform" on this date (exchange filing of 2 November).
- 30 October 2026: ThePrint reported that a group calling itself ScarlettGroup claimed to have breached the bank, as relayed by a threat-intelligence account on X. The same day, PTI reported a statement from the bank saying it was investigating a potential leak from a SaaS platform "managed and hosted by Salesforce" that "holds limited data relating to our vehicle loan customers", and that "the Bank's own systems remain unaffected".
- 2 November 2026: responding to a clarification request from BSE and NSE, the bank filed a reply (reference AUSFB/SEC/2026-27/287).
- 7 November 2026: Digit reported that a threat actor claimed on an underground forum to be selling more than 1.2 TB of the bank's data.
What the bank said in its exchange filing
In the 2 November filing, the bank said:
- the platform "is hosted and managed by a reputed global third-party vendor, is used for onboarding Bank's vehicle loan customers and contains customers' information obtained at the time of loan onboarding";
- "the incident may have resulted in data leakage of some of the Bank's vehicle loan customers";
- it is running "a detailed internal and external forensic investigation, with the help of leading cyber security firms", and that there are "~28.5 lacs vehicle loan customers onboarded through this platform";
- "The Bank's other systems remain unaffected, and all services are operating normally";
- the matter "has been reported to regulatory authorities including the Reserve Bank of India and CERT-In".
The filing does not list which data fields were involved, does not give a number of affected customers, and does not include customer advice. The 28.5 lakh figure is the number of customers on the platform, not a confirmed number of people whose data leaked.
What has only been claimed
| Claim | Who made it | Status |
|---|---|---|
| The bank was breached; the data includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications and signed agreements | A group calling itself ScarlettGroup, as reported by ThePrint and Digit on 30 October | Unverified. ThePrint said it could not independently verify the claims, and that the bank did not say whether the platform is the source of the data the group claims to hold. |
| More than 1.2 TB of data, including 2,282,619 "live customer accounts", offered for sale for USD 8,500, and the bank's core systems breached | An unnamed seller on an underground forum, as relayed by a threat-intelligence account and reported by Digit on 7 November | Unverified. Digit said the claims had not been independently verified. The bank's filing says its other systems remain unaffected. |
Until the bank or a regulator confirms more, treat these as claims, not facts. EpiFive has not seen or verified any of the data.
Am I affected?
You are most likely to be in scope if you took a vehicle loan from AU Small Finance Bank, or applied for one, because the bank says the platform holds information collected at loan onboarding. The bank has not said which customers' records leaked, and it has not published a lookup tool.
Whether or not your record is in any leaked set, the practical risk is the same: fraudsters who hold real loan details (your name, phone number, vehicle, loan amount or EMI date) can make a scam call or message sound genuine. Act as if your loan details are known to strangers.
What to do now
1. Treat loan-related calls, SMS and WhatsApp messages with suspicion
Expect messages that mention your real loan and ask you to "update KYC", pay an overdue EMI through a link, claim a refund, or settle a "penalty". Do not click links, scan QR codes or call numbers given in the message. Fraud often uses urgency: a deadline, a threat of legal action or a vehicle seizure. Hang up and check with the bank yourself.
2. Never share OTP, PIN, CVV or passwords
AU Bank says it "will never ask for OTP, PIN, CVV, passwords, or card details", and that it never asks customers to install an APK file. No genuine bank employee needs your OTP. If anyone asks for it, the call is a scam. Install banking apps only from the Google Play Store or Apple App Store. Our guide to spotting phishing SMS and email in India shows common patterns.
3. Verify that a call is genuinely from AU Bank
Under its "One Bank One Number" initiative, AU Bank says: "All official transaction or service-related calls from AU Small Finance Bank will always begin with '1600'." If a caller claiming to be from AU Bank uses any other number, the bank's advice is not to engage, not to share information, and to disconnect. Even on a 1600 call, never share an OTP or PIN. When in doubt, end the call and ring the bank's toll-free numbers yourself: 1800 1200 1200 or 1800 26 66677, as listed on the bank's own website. Report suspicious numbers at sancharsaathi.gov.in, which the bank also recommends.
4. Check your credit report for loans you did not take
Leaked KYC details can be used to apply for loans or credit cards in your name. The RBI requires every credit information company to give you one free full credit report, including your credit score, once a year (January to December). Download your report from each bureau's official website (TransUnion CIBIL, Experian, Equifax and CRIF High Mark) and look for loans, cards or recent enquiries you do not recognize. RBI rules also require bureaus to send you an SMS or email alert when a lender pulls your report and the enquiry shows in it; an alert you did not expect is a warning sign. Dispute anything unknown with the bureau and the lender.
5. Lock your Aadhaar biometrics
If you are worried about misuse of your Aadhaar, UIDAI offers a free biometric lock. UIDAI says a registered mobile number is mandatory and an OTP is used to turn the lock on or off. You can lock biometrics through the UIDAI website (myAadhaar) or the Aadhaar app. While biometrics are locked, fingerprint, iris and face authentication fail; OTP-based authentication still works. A temporary unlock lasts "generally 15 minutes" or one transaction. UIDAI also suggests reviewing your authentication history if you suspect misuse. The UIDAI helpline is 1947.
6. Watch your accounts and switch on alerts
Turn on SMS and email alerts for every debit, and read them. Check your loan account statement for payments you did not make. If someone you do not know contacts you about "your loan", do not confirm any details; call the bank on its listed number.
If you have lost money or shared details
Act within minutes, not days. Under RBI rules, how quickly you report an unauthorised electronic transaction affects how much of the loss you may have to bear.
- Call your bank to block cards and report the transaction. AU Bank lists 1800 1200 1200 and 1800 26 66677 for reporting unauthorised transactions; you can also report fraud on a transaction in the AU 0101 app or net banking, or email [email protected].
- Call 1930 or file a complaint on cybercrime.gov.in. The National Cyber Crime Reporting Portal and the 1930 helpline are run by the Ministry of Home Affairs for online fraud complaints. Keep transaction IDs, the caller's number and screenshots.
- Change passwords and PINs for net banking, UPI apps and email, and turn on two-step verification on your email account.
- Escalate if needed. If the bank does not resolve your complaint, you can complain to the RBI Ombudsman at cms.rbi.org.in (contact centre 14448).
If a caller has asked you to stay on a video call, threatened arrest or demanded payment to "close a case", read our guide to the digital arrest scam. If your mobile number suddenly stops working, see SIM swap fraud.
How to protect yourself after any bank data leak
- Assume anyone who knows your loan or account details may still be a fraudster.
- Call the bank only on numbers from its official website, app or your statement, never from a message or a search ad.
- Keep your OTP, PIN, CVV and passwords to yourself, always.
- Check your credit report at least once a year, and after any breach notice.
- Keep Aadhaar biometrics locked if you do not use fingerprint-based services such as AePS.
- Report every fraud attempt on 1930 or cybercrime.gov.in, even when you lost nothing; it helps block the numbers.
What we checked
- Downloaded the bank's 2 November 2026 reply to BSE and NSE (reference AUSFB/SEC/2026-27/287) from bseindia.com on 2026-11-12 and quoted its wording directly; the 28.5 lakh figure, the date of 29 October and the reporting to RBI and CERT-In come from that filing.
- Compared the filing with the bank's 30 October statement as reported by PTI on ThePrint; only the press statement names Salesforce. We could not find a separate exchange filing dated 30 October.
- Read ThePrint (30 October) and Digit (30 October and 7 November) for the ScarlettGroup and 1.2 TB claims and confirmed that both outlets describe them as unverified.
- Opened AU Bank's "Report Unauthorised Transactions" page and its "Bank Calls Starting With 1600" page on au.bank.in for the toll-free numbers, the 1600 rule and the "never ask for OTP" statement.
- Checked UIDAI's authentication FAQ for the biometric lock rules (registered mobile, OTP, 15-minute temporary unlock) and the 1947 helpline on uidai.gov.in.
- Checked the RBI Credit Information Companies Directions, 2025 for the free annual credit report and access alerts, the RBI customer-liability circular, cms.rbi.org.in for the Ombudsman contact centre, and the Ministry of Home Affairs press release on PIB for 1930 and cybercrime.gov.in.
- Not verified: which data fields leaked and how many customers were affected, because the bank has not disclosed them as of 2026-11-12. sancharsaathi.gov.in did not load for us, so its reporting steps are not described here.
Last tested: 2026-11-12
Sources
- AU Small Finance Bank, reply to clarification sought by stock exchanges, 2 November 2026 (AUSFB/SEC/2026-27/287), BSE: https://www.bseindia.com/xml-data/corpfiling/AttachLive/7ab4c849-67d1-4cc7-b74d-dc5f8a34281a.pdf
- ThePrint (PTI), AU Small Finance Bank probing potential data leak of vehicle loan customers, 30 October 2026: https://theprint.in/economy/au-small-finance-bank-probing-potential-data-leak-of-vehicle-loan-customers/3086435/
- ThePrint, AU Small Finance Bank probes potential data leak from SaaS platform after hacker group claims breach, 30 October 2026: https://theprint.in/tech/au-small-finance-bank-probes-potential-data-leak-from-saas-platform-after-hacker-group-claims-breach/3086172/
- Digit, 30 October 2026: https://www.digit.in/news/general/au-small-finance-bank-data-compromised-hackers-allegedly-steal-pan-aadhaar-and-other-sensitive-customer-data.html
- Digit, 7 November 2026: https://www.digit.in/news/general/au-small-finance-bank-data-breach-row-deepens-over-22-lakh-customer-accounts-allegedly-put-up-for-sale.html
- AU Small Finance Bank, Report Unauthorised Transactions: https://www.au.bank.in/report-unauthorised-transactions
- AU Small Finance Bank, Bank Calls Starting With 1600: https://www.au.bank.in/blogs/identify-genuine-bank-calls-prevent-fraud
- UIDAI, Authentication FAQs (Aadhaar lock and biometric lock): https://uidai.gov.in/en/authentication
- RBI, Credit Information Companies Directions, 2025: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12926
- RBI, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0
- RBI Complaint Management System: https://cms.rbi.org.in
- PIB, Ministry of Home Affairs, 28 July 2026 (1930 and cybercrime.gov.in): https://www.pib.gov.in/PressReleasePage.aspx?PRID=2290366®=3&lang=1
- National Cyber Crime Reporting Portal: https://cybercrime.gov.in
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.