Partners Financial Services, a.s.
Saldırı bilgileri
- Sektör
- Finans
- Ülke
Çek Cumhuriyeti- Saldırı tarihi
- 11.09.2026
- Tespit tarihi
- 12.11.2026
- Saldırgan grup
- Incransom
- Sızıntı durumu
- Sızıntı sitesinde henüz yayınlanmadı
Kurum hakkında
# PARTNERS FINANCIAL SERVICES, a.s. — DATA BREACH **Date:** September 2026 **Target:** Partners Financial Services, a.s. (IČO: 27699781) **Location:** Prague, Czech Republic **Industry:** Financial Services / Banking / Insurance --- ## WHO IS PARTNERS? Partners Financial Services is the **largest independent financial advisory and brokerage firm in the Czech Republic**. Founded in 2007, the group has grown to include: - **Partners Banka** — a fully licensed bank (ČNB license, launched March 2024) - **Partners investiční společnost** — investment fund management (7.2 billion CZK AUM) - **Simplea pojišťovna** — life insurance company (64,000+ clients) - **Rentea penzijní společnost** — pension fund (2 billion CZK AUM) - **Trigea nemovitostní fond** — real estate fund (3.7 billion CZK AUM) - **NextPage Media** — Peníze.cz, Finmag, Heroine.cz **Revenue:** >3 billion CZK/year (~€120M) **Assets Under Management:** ~13 billion CZK (~€520M) **Financial Advisors:** 2,000+ **Branches:** 170+ across Czech Republic **Clients:** 300,000+ Ownership: **Petr Borkovec** (CEO, 49%) and **Radim Lukeš** (co-founder, 36%). --- ## WHAT WAS COMPROMISED ### 1. COMPLETE ACTIVE DIRECTORY FOREST — 10 DOMAINS The entire AD forest was extracted including full NTDS.dit: Domain Accounts Entity |--------|----------|--------| partners.cz 888 HQ — Partners Financial Services pfs.local 708 Core internal domain simplea.cz 132 Simplea insurance simplea.sk 38 Simplea Slovakia rentea.cz 36 Rentea pension fund partnersis.cz 36 Partners investment company nextpagemedia.cz 4 NextPage Media merity.cz 3 Merity fund simplea.pl 1 Simplea Poland penize.cz 1 Peníze.cz media **Total: 3,338 AD objects — 1,856 users — 1,482 computers — 156 privileged admins** Golden Ticket material (krbtgt) extracted — permanent forest-wide access. Domain Admin hash + AES-256 keys + Kerberos TGT + PKI certificate with private key. ### 2. 1,324,203 CLIENT CALL RECORDINGS (2008–2021) Thirteen years of recorded phone conversations from the Partners call center: - **1,324,203 WAV files** with **1,323,829 unique caller IDs** - Clients discussing **mortgages, investments, insurance, pensions** - Contains: client voice, phone numbers, full financial details - Period: **2008 to 2021** (~130,000 recordings per year at peak) This is **maximum GDPR-sensitive data** — financial conversations of hundreds of thousands of Czech citizens. ### 3. CLIENT DATABASE (SQL) - **ClientHistory** — full client financial history (PII) - **Anonymizace** — GDPR anonymization pipeline (proves they know this data is sensitive) - Production AlwaysOn Availability Group (Cluster036) — full/diff/log backups from August 2026 ### 4. VEEAM BACKUP INFRASTRUCTURE - **15 production server images** (full .vbk backups, restorable) - **7+ NAS repositories** across multiple sites - **VMware vSphere** full admin access (vsphere.pfs.local) - **Azure Cloud Connect** — off-site backup credentials - **DELL PowerStorage** — storage infrastructure - **Proxmox** — secondary hypervisor - Backup period: November 2023 to August 2026 ### 5. COMPLETE IT INFRASTRUCTURE - Microsoft Dynamics CRM (client data) - Dynamics NAV ERP (financial operations) - SharePoint intranet (12 service accounts) - 188 IIS application pools - CheckPoint firewall - Kofax document management - Exchange/M365 email ### 6. CRACKED CREDENTIALS Passwords already cracked from the NTDS dump: ``` qwerqwer → 7 accounts (adkofax, OfficeZ, hrsit, DPokorny, vars, vratky, web) September2023 → simplea.sk\XVidrova dominik521 → pfs.local\DHutecka Neutrogena123 → partners.cz\KPtackova J1j2j3j4j5j6 → partners.cz\JKonicek Administrator77 → partners.cz\NAutratova ``` 3,325 additional hashes pending crack. --- ## DATA VOLUME Category Count |----------|-------| Call recordings (WAV) 1,324,203 files AD objects 3,338 NTLM hashes 3,331 Kerberos keys 12,470 VM backup files 108 SQL backup files 398 Veeam storage blobs ~5,600 **Estimated total** **~1.5–2.5 TB** --- ## REGULATORY EXPOSURE Partners Financial Services operates under supervision of: - **ČNB (Czech National Bank)** — Partners Banka has a full banking license. This breach directly threatens that license. - **ÚOOÚ (Czech Data Protection Authority)** — GDPR breach with 1.3M client call recordings. Fine up to **4% of annual turnover (~€5M)**. - **GDPR Article 33** — Mandatory 72-hour breach notification to hundreds of thousands of affected clients. - **NBS (Slovakia)** — Simplea SK operations. Partners/Borkovec chairs **AFIZ** (Association of Financial Intermediaries and Advisors) — the industry body that is supposed to ensure standards. The company already received negative coverage on **Černé ovce (ČT, 2025)** for advisor misconduct. This breach proves systemic security failure. --- ## PROOF Screenshots and sample data available. We can provide: - Any 10 files from the 1.3M+ file tree on request - NTDS dump samples with domain attribution - WAV recordings with caller IDs - Veeam job metadata proving backup infrastructure access - SQL database headers --- ## TIMELINE Partners Financial Services was given the opportunity to resolve this matter privately. Their response determines next steps. --- *Partners Financial Services, a.s. Türkova 2319/5b, 149 00 Praha 4 IČO: 27699781*
Incransom grubunun son saldırıları
İletişim
Yardıma mı ihtiyacınız var?
Veri kurtarma ile ilgili sorularınız ve talepleriniz için bize ulaşın.