AU Small Finance Bank investigates potential vehicle-loan data leak

AU SMALL FINANCE BANK LIMITED said on November 2, 2026, that it was investigating a potential data leak at a third-party vehicle-loan onboarding platform used for about 28.5 lakh customers, while forensic work had not established the nature or extent of any leakage.

What happened at AU Small Finance Bank’s vehicle-loan platform?

AU Small Finance Bank became aware of the potential data-leak incident on October 29, 2026, according to its November 2 clarification to stock exchanges. The incident concerns a third-party Software-as-a-Service, or SaaS, platform used to onboard the bank’s vehicle-loan customers.

The platform is hosted and managed by what AU Small Finance Bank described as a reputed global third-party vendor. It contains customer information obtained during vehicle-loan onboarding, but the November 2 filing did not identify the data fields that may have been involved or confirm that every record on the platform was accessed.

AU Small Finance Bank said preliminary findings indicated that data leakage may have affected some vehicle-loan customers. This distinguishes the potential incident from a confirmed count of affected records, as the bank continues to investigate a platform used for approximately 28.5 lakh onboarded vehicle-loan customers.

How many AU Small Finance Bank customers could be affected?

About 28.5 lakh vehicle-loan customers were onboarded through the SaaS platform at the centre of AU Small Finance Bank’s investigation. This is the population whose onboarding information was held on the platform, rather than a confirmed number of customers whose data was leaked.

AU Small Finance Bank did not provide a numerical estimate of affected customers in its November 2, 2026 disclosure. Instead, it said the potential leakage may involve some vehicle-loan customers and that internal and external forensic work is intended to establish both the nature and extent of any leakage.

The filing therefore presents two different measures: the platform contained onboarding information for about 28.5 lakh vehicle-loan customers, while the verified scope of the potential incident remains unresolved. Customers and investors cannot infer that all platform users were affected because AU Small Finance Bank did not make that claim.

What customer information may be involved at AU Small Finance Bank?

AU Small Finance Bank said the platform contains customer information collected during vehicle-loan onboarding. The November 2 filing did not specify whether potentially leaked information included identity details, contact information, loan documentation, account data, credentials or another category of records.

The disclosure limits the potentially involved data, if any, to information obtained through the vehicle-loan onboarding process. AU Small Finance Bank’s forensic investigation is examining the nature of the potential leakage, leaving open what information may have been exposed and how broadly it may have been accessed.

The distinction between customer information held by the platform and confirmed leaked information is material. As of the November 2 clarification, AU Small Finance Bank had disclosed the source of the information, namely vehicle-loan onboarding, but had not disclosed a dataset, duration of exposure or confirmed method by which potential leakage occurred.

Are AU Small Finance Bank’s other systems and services affected?

AU Small Finance Bank said its other systems remain unaffected and all services are operating normally. Its November 2 filing also said the potential platform incident had no impact on business operations, financial performance or business continuity at the time of disclosure.

Unlike the third-party SaaS platform used for vehicle-loan onboarding, AU Small Finance Bank’s other systems were reported as unaffected. The bank did not report a service disruption, interruption to business continuity or financial-performance effect in its November 2 clarification, although the platform investigation remains in progress.

AU Small Finance Bank described customer protection as its highest priority in the November 2 filing. That is a management assurance alongside the reported operating status, rather than a conclusion on the eventual number of vehicle-loan customers or categories of onboarding information found to be involved.

What has AU Small Finance Bank done after identifying the potential leak?

AU Small Finance Bank said it is conducting a detailed internal and external forensic investigation with the help of leading cybersecurity firms. The stated purpose is to determine the nature and extent of the potential data leakage involving the third-party platform identified on October 29, 2026.

AU Small Finance Bank has also reported the matter to regulatory authorities, including the Reserve Bank of India and the Indian Computer Emergency Response Team, or CERT-In. The bank said the reporting was made in accordance with applicable regulatory requirements, but its November 2 filing did not state notification dates or describe regulatory responses.

AU Small Finance Bank said it would continue to monitor the situation closely and make further disclosures if required under applicable regulatory requirements. The main unresolved issue is the forensic outcome: the filing confirms the 28.5 lakh-customer platform population but not a count of records potentially leaked.

Conclusion

The November 2, 2026 clarification establishes that AU Small Finance Bank is examining a possible third-party SaaS platform leak tied to vehicle-loan onboarding information for a platform population of about 28.5 lakh customers. It also says other systems and services remain unaffected, with no reported impact on operations, financial performance or business continuity.

The next item to watch is AU Small Finance Bank’s forensic finding on the nature and extent of the potential leakage. The bank said on November 2 that it had notified the Reserve Bank of India and CERT-In and would make further disclosures if required, but it did not provide a completion date for the investigation or a confirmed affected-customer count.