Quick Summary
- AU Small Finance Bank said it is investigating a potential data leak involving a Salesforce-managed software platform that holds limited vehicle-loan customer information.
- The bank said its own systems were unaffected and that banking services continued to operate normally.
- A hacker group has claimed access to a broader set of records, but the bank and independent reporting have not confirmed the full scope or the number of affected customers.
The bank is investigating a third-party platform
AU Small Finance Bank has said it is investigating a potential data leak involving a software-as-a-service platform managed and hosted by Salesforce. The bank told reporters that the platform held limited information relating to vehicle-loan customers and that its own systems remained unaffected. It also said that banking services were operating normally. The statement distinguishes the reported issue from a confirmed compromise of the bank’s core banking infrastructure.
The investigation follows claims by a hacker group that it had accessed customer and internal records. The group alleged that the material included identity documents, loan information and other sensitive data. Those claims have not been independently verified in full, and the bank has not confirmed how many records may have been exposed. The presence of a data sample or a threat posted online does not by itself establish the completeness or authenticity of the alleged dataset.
The involvement of a third-party SaaS platform is important because organisations increasingly store customer information across multiple cloud services. A bank may operate its own core systems while using external platforms for customer relationship management, loan processing or support workflows. Each integration creates another place where access permissions, authentication and data retention must be managed.
Cloud services can provide scalability and specialised features, but they do not remove the customer organisation’s responsibility to understand what information is stored and who can access it. Security reviews should cover user roles, API credentials, connected applications, audit logs and the process for revoking access when a vendor account or integration is suspected of compromise.
An investigation should establish whether the alleged data came from the platform identified by the bank, which fields were present, whether the records were accessed or downloaded and whether any information was misused. It should also determine whether the incident involved a compromised account, a misconfigured permission, an exposed integration or another route. Without those details, it is not possible to assess the actual risk to customers.
Customers should be alert to targeted phishing if personal or loan-related information is confirmed to have been exposed. Attackers can use details such as loan status, identity information or contact history to make fraudulent messages appear credible. Anyone receiving unexpected requests for passwords, one-time codes or payments should verify them through the bank’s official channels.
Reuters reported that the bank had not provided details about the nature or scope of the potential leak. That means there is no confirmed figure for affected customers and no basis for stating that all the data listed by the hacker group was obtained. The distinction between an allegation and a verified breach is important when reporting incidents involving financial or identity information.
The episode adds to scrutiny of third-party technology risk in the financial sector. Banks rely on a complex network of vendors, cloud services and data processors, and security controls must extend across those relationships. The next important update will be a clearer account of the affected platform, the categories of data involved and whether customers need to take any protective action.
The ruling concerns the regulator's information powers
The court challenge focused on Ofcom's ability to request information under the Online Safety Act, rather than a blanket approval of every future demand the regulator might make. The platforms had argued that the requests were unlawful, but the court rejected their challenge. Ofcom can now continue using the statutory powers at issue, subject to the limits of the legislation and the ordinary legal process.
For services operating in the UK, the dispute shows that compliance work is not limited to removing illegal content or changing recommendation systems. Companies may also need to preserve records, explain how their services operate and respond to requests for information about safety risks. The regulator's ability to collect evidence is important because enforcement depends on more than public statements from platforms. The next stage will be how Ofcom uses the information and whether the companies raise objections to specific requests in future proceedings.