AU SFB Probes Potential Data Leak, Vijay Sales’ Admin Access Allegedly Listed For $25K

AU Small Finance Bank (AU SFB) is investigating a potential data leak involving a Salesforce-hosted software platform holding limited information on its vehicle loan customers, after a hacker group claimed to have accessed sensitive customer and internal records.

The Jaipur-headquartered lender confirmed the investigation, while maintaining that its own systems remain unaffected and all banking services are operating normally.

Separately, a threat actor has allegedly offered administrator access to electronics retailer Vijay Sales’ systems for $25,000. Neither the extent of the alleged access nor the extraction of any data has been independently confirmed.

The AU SFB investigation follows a post flagged by cybersecurity tracking account Hackmanac on X. A group calling itself ScarlettGroup claimed to have breached the lender’s records and threatened to publish the allegedly stolen information.

According to the group, the information includes KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, and insurance records.

It also claimed to have accessed customer relationship management (CRM) data, employee information, and audit logs. Inc42 could not independently verify these claims.

“AU Small Finance Bank is investigating a potential data leak involving a software-as-a-service (SaaS) platform managed and hosted by Salesforce, which holds limited data relating to our vehicle loan customers,” a bank spokesperson told ThePrint. “We reaffirm that the Bank’s own systems remain unaffected and all banking services are operating normally.”

The lender did not confirm whether the Salesforce-hosted platform was the source of the data the group claims to hold. It also did not disclose how many customers may have been affected.

AU SFB partnered with Salesforce in 2024 to digitise onboarding for its vehicle loan customers and streamline their journeys. At the time, Bhaskar Karkera, head of retail assets at AU SFB, described Salesforce as the bank’s partner in digitising customer journeys for vehicle loans.

Salesforce customers have previously faced cyberattacks involving social engineering and compromised third-party application connections. In one campaign, attackers used voice phishing to trick employees into connecting malicious applications to corporate Salesforce accounts, potentially exposing customer data.

However, there is no verified evidence linking the AU SFB incident to those campaigns or establishing that Salesforce’s core platform was compromised.

Vijay Sales Access Claim

Separately, an actor using the handle ‘shinymontanna’ claims to be selling super administrator access to Vijay Sales’ internal systems for $25,000, according to a post shared by the X account DarkWeb Informer.

Super administrator access typically gives a user broad control over a system, including the ability to manage other users and their permissions.

The listing claims access to more than 3 Mn order records, information on 15,000 employees, and billing records relating to approximately 1.4 Lakh vendors.

The actor further claims that the access covers customer information, payment and bank transfer records, inventory, financial reports, and internal applications, with permissions to view, modify, and export data.

Screenshots purportedly showing administrative dashboards and super administrator privileges have also been circulated.

However, the claims remain unverified. There is no independent confirmation of the extent of the alleged access or whether any customer or corporate information has been extracted.

Vijay Sales did not respond to Inc42’s queries on the matter.

The developments follow other recent cybersecurity incidents involving customer data exposure and vulnerabilities in digital systems.

Earlier this month, SBI flagged the exposure of 3,897 customer records on the dark web. The records reportedly included personal information such as mobile numbers, dates of birth, email addresses, and residential addresses.

Separately, two critical vulnerabilities in PHP, an open-source programming language widely used to build websites, came to light, prompting governments and companies worldwide to take emergency action.

Cybersecurity company eMudhra also recently announced plans to voluntarily wind down its global secure sockets layer and transport layer security (SSL/TLS) certificate business following a certificate security incident.

A researcher found that private keys associated with eight of its intermediate certificate authorities (CAs), which issue digital certificates used to secure website connections, could be recovered.

eMudhra said it revoked all eight affected intermediates and that no certificates had been issued from them. It also said its infrastructure had not been compromised and no data had been breached.

The post AU SFB Probes Potential Data Leak, Vijay Sales’ Admin Access Allegedly Listed For $25K appeared first on Inc42 Media.