AU Small Finance Bank is investigating a possible exposure of limited vehicle-loan customer information on a Salesforce-managed service, while Salesforce told Press Trust of India it had not identified a related vulnerability.
Salesforce said, “Based on currently available information, we have not identified a vulnerability in the Salesforce platform related to this issue,” PTI reported Oct. 31. PTI also reported that Salesforce declined to discuss specific customer matters, citing its policy, and said its teams were actively helping customers as needed. The statement addresses Salesforce’s vulnerability assessment; it does not establish whether anyone accessed customer data.
The bank said Oct. 30 that the service under investigation was managed and hosted by Salesforce and held limited information about vehicle-loan customers. It said its own systems and banking services were unaffected. ThePrint reported that the bank had not linked that service to the records claimed by the hacking group or given a possible customer count.
ScarlettGroup claimed it had obtained customer and internal bank records, including identity, financial and loan information. Threat-monitoring account Hackmanac flagged the claim Oct. 29 and said verification was pending. ThePrint said it could not independently verify the allegation.
The bank and Salesforce announced a vehicle-loan onboarding collaboration on March 26, 2024. The bank’s announcement described document checks and data validation, but did not establish that the collaboration’s platform is the service now under investigation.
The reports reviewed provided no investigation findings or date for a further update.
