A hacker group claims to have stolen sensitive AU Small Finance Bank customer data, but the alleged breach remains unverified.
What Data Has the Hacker Group Claimed to Steal?
A hacking group identifying itself as ScarlettGroup has claimed responsibility for an alleged cyberattack on AU Small Finance Bank, threatening to publish sensitive customer information and internal records.
The claims, flagged by cybersecurity monitoring account @I4ckmanac on X, include alleged access to know your customer (KYC) documents, Permanent Account Number (PAN) details and Aadhaar information. The group also claims to possess credit reports, bank statements, loan applications, signed agreements, insurance records and customer relationship management data.
Internal employee information, login histories and audit logs were also mentioned. However, the volume of allegedly stolen information remains unknown, and the group’s claims have not been independently verified.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Has AU Small Finance Bank Confirmed the Breach?
AU Small Finance Bank had not issued an official statement confirming or denying the alleged breach at the time of reporting. Neither the authenticity of the purportedly stolen records nor the extent of any unauthorised access had been established.
Cybersecurity tracking platform Ransomware.live reportedly recorded a claim involving the domain au.bank.in on October 29, 2026. The listing attributed the alleged incident to ScarlettGroup and indicated that a negotiation countdown was associated with the claim. However, researchers had not independently confirmed the countdown details or examined a published sample of the allegedly stolen information.
What Is Known About ScarlettGroup?
Cybersecurity firm Foresiet described ScarlettGroup as a relatively new threat actor that began appearing in monitoring records around September 2026 and became more visible during October.
The group reportedly operates an extortion platform on the Tor network, where alleged victims are listed alongside negotiation deadlines. Its stated process involves public identification, negotiations and possible disclosure of information if a settlement is not reached.
ScarlettGroup has previously claimed attacks involving contact-centre software company Genesys and Rajasthan Police. Genesys acknowledged unauthorised access to certain internal systems but did not identify ScarlettGroup as responsible.
In the Rajasthan Police case, the group claimed possession of approximately 70,000 identity records and 59,460 mobile numbers. Authorities had not independently confirmed the full extent of that alleged breach.
These earlier incidents underline the difficulty of establishing the reliability of claims made by cyber extortion groups.
What Should Customers Know About the Alleged Incident?
If the alleged exposure is confirmed, the combination of identity documents and financial records could increase risks of impersonation, fraudulent loan applications and targeted phishing attempts.
Customers have been advised to remain cautious about unsolicited calls, emails and WhatsApp messages claiming to concern their bank accounts, loans or cards. Personal information, passwords, PINs and one-time passwords should not be disclosed to unknown callers.
Account holders should also examine banking transactions, loan accounts and credit reports for unfamiliar activity. Official bank communication channels should be used to verify suspicious requests.
Financial cybercrime complaints can be registered through the national helpline 1930 or cybercrime.gov.in.
If unauthorised access is established, the bank would face applicable cybersecurity reporting requirements involving CERT-In and the Reserve Bank of India.
For now, the central questions remain unanswered: whether any breach occurred, what information may have been accessed and whether the attackers possess authentic customer records.
