AU SFB probes potential Salesforce data exposure as retailer’s admin access surfaces on da

AU Small Finance Bank is examining claims of a data leak tied to a Salesforce-hosted platform used for vehicle loan customer records, while a threat actor has allegedly put administrator-level access to electronics retailer Vijay Sales’ systems up for sale. Neither incident has been confirmed, but both underscore risks tied to third-party SaaS tools and the underground market for corporate access.

According to reports, AU SFB launched its investigation after a hacker group posted claims of a breach, alleging access to sensitive customer and internal records. The bank acknowledged the probe but stated that its own systems remain secure and that the Salesforce platform in question contains only limited data. It did not address whether the platform was the source of the alleged breach or specify the number of customers potentially affected.

The bank had previously adopted Salesforce to modernize its vehicle loan onboarding process. While Salesforce customers have faced past attacks—often involving social engineering or compromised third-party apps—there’s no evidence linking those incidents to the current case. The bank emphasized that its services are operating normally, though the investigation continues.

In a separate case, a seller on the dark web has allegedly offered super administrator access to Vijay Sales’ internal systems for a five-figure sum. The listing, shared by a cybersecurity monitoring account, claims broad access to order records, employee data, and vendor billing information, along with permissions to alter or export sensitive data. Screenshots purporting to show administrative dashboards have circulated, but the claims remain unverified. Vijay Sales has not responded to inquiries.

These developments follow other recent cybersecurity incidents, including reports of customer data appearing on underground forums and critical vulnerabilities in widely used software. One financial institution recently disclosed the exposure of thousands of customer records, while a certificate authority announced plans to wind down part of its business after a security researcher identified risks in its infrastructure.

The incidents reflect broader challenges in securing SaaS integrations. Even platforms handling narrow datasets—such as loan onboarding—can become targets if they contain sensitive identifiers. Meanwhile, the sale of administrative access suggests attackers may prioritize control over systems rather than just raw data, particularly when financial or vendor records are involved.

For enterprises, the cases serve as a reminder that third-party SaaS tools require the same scrutiny as internal systems. Companies should monitor for unauthorized access, especially in platforms managing financial or vendor data, and ensure robust audits of third-party connections. How AU SFB and Vijay Sales respond—whether through disclosures, legal action, or security upgrades—will offer further insight into the risks of SaaS-driven digitization.

Sources: inc42.com