Two separate data leak claims hit Indian companies in the last week of October 2026. AU Small Finance Bank (AU SFB), based in Jaipur, says it is investigating a "potential data leak" on a Salesforce-hosted platform that holds what it calls "limited data" on its vehicle loan customers. A hacking group calling itself ScarlettGroup has claimed the breach and says it will publish the data. In a separate case, a seller using the handle "shinymontanna" is offering what it calls "super administrator" access to electronics retailer Vijay Sales' internal systems for $25,000. The listing claims more than 3 million order records. Coverage has described the two incidents together as affecting "millions of Indians," but that is not established. The only figure in the millions is the seller's own unverified claim about Vijay Sales orders. No record count has been given for AU SFB. Vijay Sales has not publicly commented in any of the reporting so far, and no regulator filing has been published for either company.
What Happened
AU Small Finance Bank. The cybersecurity monitoring account Hackmanac first reported ScarlettGroup's claim in a post on X on Thursday, 29 October. HackRisk, cited by CNBC TV18, also tracked the claim. The group said it had breached the bank's defences and threatened to leak customer and internal corporate data. The bank's position changed over the following day. Early reports, including Free Press Journal on the morning of 30 October, said the bank had not acknowledged the incident. Later on 30 October the bank issued a statement, and outlets quote it in two slightly different forms:
- CNBC TV18 quotes the bank as reporting "potential data leakage at their Salesforce platform, SaaS system managed and hosted by Salesforce, which has limited data of wheels customers."
- PTI, carried by The Economic Times and The Hindu BusinessLine, and Inc42 quote it as "investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers."
Both versions say the same thing: the bank's own systems are unaffected and banking services are running normally.
On Saturday, 31 October, Salesforce said that "based on currently available information, we have not identified a vulnerability in the Salesforce platform related to this issue." It added that it does not comment on specific customer issues and that its teams are working with customers as needed.
Vijay Sales. The X account Dark Web Informer reported that "shinymontanna" had listed alleged super administrator access to the retailer's internal systems for $25,000. Outlets convert that to Indian rupees differently: roughly ₹24 lakh according to News9, and nearly ₹22 lakh according to Times Now. News9 reports that the seller shared screenshots of an alleged admin dashboard. Inc42, News9 and Times Now all say the claim is unverified and that there is no confirmed evidence of a successful breach across Vijay Sales' systems.
No reporting links the two incidents to the same actor. Treat them as separate cases.
What Was Taken
AU SFB, according to the attackers. ScarlettGroup's claim, as reported by Hackmanac and repeated by several outlets, covers:
- KYC records and identity documents, including PAN and Aadhaar details
- Credit reports, bank statements, loan applications and signed loan agreements
- Insurance records and CRM data
- Employee information, login histories and internal audit logs
The bank's account is much narrower. It says the data involved is "limited" and relates to vehicle loan customers held on a single Salesforce-hosted platform. No one has independently verified the attackers' list, and neither the bank nor the attackers have given a record count. Inc42 and Free Press Journal both say they could not verify the claims. The gap between "limited vehicle loan data" and "KYC, credit reports and audit logs" has not been resolved. Even so, loan origination workflows often keep KYC documents and signed agreements inside the CRM, so the two accounts may describe the same data at different levels of detail.
Vijay Sales, according to the seller. The listing claims:
- More than 3 million order records (reported as 30 lakh by News9)
- Information on about 15,000 employees
- Billing records for about 140,000 vendors (1.4 lakh)
- Customer information, payment and bank transfer records, inventory data, financial reports and access to internal business applications
Times Now reports that the listing advertises read, write and export permissions. This case is different in kind from AU SFB's. What is for sale is live access, not a data dump, so anyone who buys it could tamper with records or set up fraud, not only copy data.
Why It Matters
PAN and Aadhaar numbers, bank statements and signed loan documents are exactly what someone needs to impersonate a borrower. If ScarlettGroup's data is real and is published, likely abuses include fraudulent loans and new accounts opened in victims' names, and convincing phishing that quotes real loan details. Vehicle loan customers should expect calls or messages that cite their actual loan terms.
The Salesforce detail matters most to defenders. When a vendor says there is "no vulnerability in the platform" while its customer confirms a leak on that platform, the problem usually sits on the customer's side of the shared responsibility model: credentials, connected apps, integrations or access settings. Many organisations treat their SaaS CRM as a contained third-party system. It often holds some of the most sensitive customer documents a firm has, with weaker monitoring than its core systems.
The Vijay Sales listing shows how initial access sales work. One administrator account sells for a five-figure sum, and the buyer could be a ransomware operator, a fraud ring or a data broker. It comes during India's festive shopping season, when order volumes and payment activity are at their highest.
Digit also notes that these claims follow other October data leak reports involving Indian organisations, including e-Mudhra and State Bank of India. PTI's coverage notes that Prime Minister Narendra Modi recently warned of growing cyberattack threats to the economy.
The Attack Technique
No one has disclosed how either intrusion happened.
For AU SFB, the confirmed facts are that the affected system is a Salesforce-hosted SaaS platform and that Salesforce has found no flaw in its own platform. That fits a compromise of the bank's own Salesforce tenant rather than of Salesforce itself. Earlier Salesforce tenant breaches have commonly involved stolen or phished user credentials, voice phishing that tricks staff into authorising a malicious connected app, abused OAuth tokens from third-party integrations, and misconfigured guest or community site access. Neither the bank nor ScarlettGroup has said which, if any, applies here.
For Vijay Sales, the seller claims super administrator access with read, write and export permissions to internal applications. No reporting says how that access was obtained. Credentials stolen by infostealer malware, reused admin passwords and exposed admin panels are the usual sources of listings like this, but nothing in the coverage confirms the method.
What Organizations Should Do
- Audit SaaS CRM tenants now. Review Salesforce and similar platforms for connected apps, OAuth grants and API-enabled users. Revoke anything unrecognised or unused, and limit which users can authorise new connected apps.
- Watch for bulk export and unusual API activity. Turn on event monitoring for report exports, Bulk API jobs and data loader use. Alert when volumes exceed a normal baseline or when activity comes from new IP addresses or user agents.
- Keep identity documents out of the CRM where possible. Store KYC files, PAN and Aadhaar copies and signed agreements in a separate, access-controlled document store, and link to them from the CRM instead of copying them in. Mask identifiers in CRM views.
- Lock down admin accounts. Require phishing-resistant MFA for all administrator and super administrator accounts. Remove standing admin rights where you can. Check infostealer log feeds for your domains so you can rotate exposed credentials before someone sells access.
- Monitor access broker markets. Track dark web and Telegram listings, and X accounts that report on them, for your brand name. When a listing claims admin access, assume it may be real and rotate privileged credentials while you investigate.
- Prepare customers for targeted fraud. If you hold loan or KYC data, tell customers how you will and will not contact them. Expect criminals to use leaked loan details to make phishing more convincing.
Sources: AU Bank, Vijay Sales data leak: Millions of Indians hit – who is af... | AU Small Finance Bank data leak: Salesforce says no vulnerability a... | AU Small Finance Bank: ScarlettGroup claims data breach; bank says... | AU SFB Probes Potential Data Leak, Vijay Sales’ Admin Access Allege... | Vijay Sales allegedly hacked: Hacker claims access to 30 lakh order... | AU Small Finance Bank Hit By Alleged Cyberattack; Hackers Claim PAN... | Vijay Sales Hacking Claims: Are Customer Details And Payment Record... | AU SFB data leak: Salesforce says no vulnerability at its end - The...