Salesforce found no platform security vulnerabilities following a suspected customer data leak at India’s AU Small Finance Bank, the enterprise software company said on Saturday.

AU Small Finance Bank opened an internal inquiry after extortion outfit ScarlettGroup claimed on Thursday to possess vehicle loan files hosted on external software.

The lender confirmed that core banking infrastructure remains unaffected, isolating the inquiry to third-party software while branch operations continue normally across the domestic network.

Threat intelligence platform Hackmanac reported that ScarlettGroup threatened to leak sensitive records taken from the bank’s perimeter. The claimed haul covers customer identity paperwork including PAN and Aadhaar records, signed loan contracts, credit bureau evaluations, bank statements, and staff credentials.

Salesforce maintains that the software platform itself shows no technical failure. The company stated that it does not discuss individual client deployments as a matter of policy, though technical teams are assisting the lender during the review.

Verification of the stolen dataset remains unresolved. Threat actors frequently publicise sample files to force negotiations before corporate defenders assess whether the exposed folders came from active systems, older backups, or third-party brokers.

Vehicle financing represents one of the most document-heavy consumer lending categories in India. Lenders assemble physical identity proof, income validation, and collateral records for every vehicle financed on the road.

A confirmed release of identity documents creates direct exposure for borrowers through identity fraud and fake account openings. For consumer retail finance desks, third-party software integrations represent an operational weak point because corporate security teams hold less visibility over vendor-managed environments.

Source link