AU Small Finance Bank, one of India's listed lenders, said on October 30 that it is investigating a possible leak of customer data after a month-old extortion crew called Scarlettgroup named the bank on its leak site. The bank's account is narrower than the crew's: it points to a third-party platform hosted and managed by Salesforce that held limited data on vehicle-loan customers, and it says its own core banking systems were not affected.
The listing for the bank's au.bank.in domain was recorded on October 29 by the ransomware.live tracker (tracker entry). The bank has not said whether the Salesforce-hosted platform is where Scarlettgroup's data came from, and nothing the crew has posted that we have seen proves what, or how much, it holds.
The bank was warned two weeks before the post
The most telling detail in AU's statement is the timeline. The bank said it received communications on October 16 from its threat intelligence service provider, from India's Defence Cyber Agency and from CERT-In, the national computer emergency response team, about a suspected exposure of customer data. That is 13 days before the leak-site listing appeared. Its banking services, it said, are running normally.
A bank pointing at a hosted software platform rather than its own network is a pattern defenders will recognise. Customer data increasingly lives in cloud CRM and service tools run by third parties, and a crew that gets into one of those can reach records without ever touching a bank's core systems. AU has not said how access to the platform was obtained.
A new crew collecting big names fast
Scarlettgroup is new. WatchGuard's ransomware tracker classifies it as a data broker that uses direct and double extortion alongside free data leaks, first sighted in September 2026, with accounts on the BreachForums and PwnForums hacking forums, a Session contact and a Telegram channel.
In roughly four weeks it has listed nine organizations, according to IntelFusions incident tracking, and the list is unusually heavy with names a general reader would know:
- Yale Books, the web shop of Yale University Press (listed early October)
- Rajasthan Police in India, which we covered in Rajasthan Police and two health providers on leak sites
- NBCUniversal and contact-centre software company Genesys (both recorded October 21)
- Automotive CRM provider VinSolutions (October 23)
- Malaysian property developer Mah Sing Group, part of the cluster in Malaysia draws six different extortion crews in one week
- Toronto's Sunnybrook Health Sciences Centre and AU Small Finance Bank (both October 29)
- US retailer Spencer's (October 30)
Apart from AU's statement, none of these organizations has confirmed a breach in anything we have seen. A data broker's listing can rest on anything from a full intrusion to a scraped or recycled dataset, and a new crew has a clear incentive to put recognisable brands on its board to look credible to buyers.
For AU customers, expect targeted scam calls
Even limited loan records are useful to fraudsters, because a caller who can quote your name, vehicle and loan details sounds like the bank. Vehicle-loan customers should treat unexpected calls, SMS or WhatsApp messages about their loan with suspicion, never share an OTP, PIN or password, and verify any request by calling the number printed on official bank documents. Organizations that keep customer data in hosted CRM platforms should review who and what can export records from them, including connected apps and API tokens, since that is the door AU's own account points to.
The more useful signal here may be the warning chain itself. A government cyber agency and the national CERT reached the bank about two weeks before the crew went public, which is the kind of early notice that turns a leak-site listing from a surprise into a known incident. More on India's threat picture is on our India country profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.