Aneesh Correa

🚨 Threat Actor Claims Massive Breach of AU Small Finance Bank, Alleging 1.2 TB Data Leak A threat actor has posted a claim on an underground forum alleging a significant data breach at AU Small Finance Bank, one of India's leading small finance banks. The actor claims to have compromised the bank's full database and is offering the stolen data for sale for $8,500. The post directly contradicts the bank's official statement issued in late October 2026, which attributed the incident to a limited data leak involving a third-party Salesforce SaaS platform affecting only vehicle loan customers. The actor alleges that the bank's own core systems were breached, not just the external SaaS platform. According to the forum post, the stolen dataset totals 1.2 TB and contains over 1 billion records. The actor claims the bank is downplaying the severity of the incident to avoid regulatory scrutiny and customer panic. The alleged compromised data includes: - 3,846,888 complete KYC identity records containing PAN, Aadhaar numbers, dates of birth, mobile numbers, emails, full addresses, and family names - 2,282,619 live customer accounts - 1,917,657 exposed bank account numbers - 938,403,770 core banking transaction and servicing records - 30,266,393 credit bureau, CIBIL, and FICO risk dossiers - 72,241,539 loan book, collateral, sanction, and insurance records - 2,871,796 signed loan agreements, scanned cheques, and customer signatures AU Small Finance Bank, headquartered in Chennai, serves millions of customers across India with a focus on financial inclusion. The exposure of Aadhaar numbers and PAN details poses severe risks of identity theft and financial fraud for the affected individuals. The actor also provided links to sample files hosted on various file-sharing services to verify the authenticity of the dump. At the time of reporting, the alleged breach has not been independently verified. While the bank has acknowledged a security incident related to a third-party platform, the extent of the compromise claimed by the threat actor remains unconfirmed by independent security researchers or regulatory bodies.