On October 29, 2026, Hackmanac reported that a group calling itself ScarlettGroup claims to have breached AU Small Finance Bank, one of India's larger small finance banks, and threatens to leak customer and internal data. The bank has not confirmed a breach. This post keeps the claim and the evidence apart.
TL;DR
| Question | Answer |
|---|---|
| Was AU Small Finance Bank breached? | Unconfirmed. Claimed by ScarlettGroup |
| Who reported it? | Hackmanac, status "pending verification" (Oct 29, 2026) |
| Bank response | A reply asking people to connect via DM; no confirmation or denial found |
| Claimed size | Not specified |
| Claimed data | KYC, PAN, Aadhaar, credit reports, bank statements, loan files, CRM, staff data, audit logs |
| Deadline | A "Negotiation Deadline" countdown of about 6d 16h on the leak page |
| Samples verified? | Not by us, and no independent verification found |
Claimed vs verified
| Claim | Status | Source |
|---|---|---|
| ScarlettGroup breached AU Small Finance Bank | Claimed by the group | Hackmanac post, leak page screenshot |
| Customer KYC data: name, date of birth, PAN, Aadhaar, contact, family, address, income, education, risk category, photos, signatures | Claimed, no sample verified | Leak page description |
| KYC API payloads, field verification notes, screening records (CKYC, CFR, RCU) | Claimed | Leak page description |
| CIBIL reports, FICO scores, bank statements, Aadhaar tokens, loan applications, approvals, collateral, insurance, disbursements, payment schedules | Claimed | Leak page description |
| Signed loan documents: eSign PDFs, KFS, sanction letters, NACH mandates, collateral agreements | Claimed | Leak page description |
| CRM person records: contacts, case notes, work orders, bureau responses, stored files | Claimed | Leak page description |
| Staff and internal identity data: employee directory, permissions, group memberships, roles, login histories, audit logs | Claimed; the screenshot we reviewed is cut off mid-list | Leak page description, Hackmanac |
| Size of the data set | Not specified | Hackmanac |
| How the attackers got in | Not stated | |
| The bank confirmed a breach | No statement found |
We reviewed the Hackmanac post text and a screenshot of the leak page. We did not access the leak site, download any samples, or test any records, and we will not. Everything above is the attackers' own description.
Why the description matters more than the label
The list reads like a large slice of a bank's systems: KYC, credit bureau data, loan paperwork, a CRM and internal identity data. If any of it is real, the impact is wide. But a long list on a leak page is cheap to write, and attackers have every incentive to make a haul sound large while the clock runs.
Three things are worth noting from the screenshot:
- It mixes data types that live in different systems. KYC stores, a loan origination platform, a CRM and staff identity data rarely sit in one place. Either the access was broad, or the list combines material from several sources, or it is padded. Nothing published tells us which.
- The CRM entry mentions "ContentVersion" stored files. That is the object name used for files in Salesforce. It suggests, but does not prove, that a Salesforce-type CRM is involved. This is an inference from a field name, not something the bank or any reporter has confirmed.
- The staff and identity section includes permissions, groups and login history. If real, that is the kind of data that helps with follow-on attacks and phishing of employees, separate from any customer harm.
What AU Small Finance Bank customers can do
Do not act in a panic on an unverified claim. A few cheap steps are worth taking either way, especially because a leak of this shape would feed phishing.
- Treat unsolicited contact as hostile. Calls, SMS, WhatsApp or email about "KYC update", "account freeze" or "loan approval" that ask for an OTP, PIN, card details or a link click are the usual lure. The bank does not need your OTP.
- Lock Aadhaar biometrics from the official UIDAI portal or the mAadhaar app, and use a masked Aadhaar or Virtual ID where a service accepts it.
- Check your credit report for loans or enquiries you do not recognise. Indian credit bureaus provide a free full report once a year.
- Watch statements and alerts. Turn on transaction alerts and report anything unfamiliar through the bank's official app, branch or the number printed on your card.
- Contact the bank through official channels only. Do not send account details by direct message to anyone claiming to be support. Impersonator accounts follow every breach story.
What to watch for
- A statement from AU Small Finance Bank, or a filing to the stock exchanges, confirming, narrowing or denying the claim.
- Any word from CERT-In or the Reserve Bank of India. Indian organizations must report cyber incidents to CERT-In within 6 hours of noticing them, so an official acknowledgement may surface.
- Whether ScarlettGroup publishes samples, and whether independent researchers can match them to real records.
- Whether the countdown passes and data is actually released.
- Other victims listed by the same group.
We will update this post as soon as the bank or a named research team confirms or refutes the claim.
If you run systems like these
Breach claims against banks are a reminder that customer data, CRM files and staff identity data tend to be reachable from the same few credentials. For teams that give AI coding agents access to repos and configs, that makes secrets on developer machines part of the risk. Beam, which runs on-device, flags and asks for approval when an agent touches credential files, so you can see where copies of long-lived secrets live. See the first 24 hours runbook for the rotation checklist.
Related reading
- October 2026 attacks timeline
- PwC Everest breach claim: claimed vs verified
- CERT-In: AI agents accessed live Indian systems
- Latin American banks and AI-assisted attacks
- US banks block AI agents from customer credentials
- What to do after an attack on your app
Sources: Hackmanac alert on X, Oct 29, 2026 · HackRisk · leak page screenshot (reviewed, not accessed directly)
Details are accurate as of October 29, 2026. This is a developing claim and may change.