The Incransom ransomware group says it broke into Partners Financial Services, a.s., one of the largest financial advisory firms in the Czech Republic. The group claims it took full control of the firm's Active Directory forest and stole 1,324,203 recorded client phone calls dating from 2008 to 2021. The threat intelligence site QPulse reported the claim on November 12, 2026 and rated it 95 out of 100 for severity. Partners Financial Services has not commented publicly. No regulator filing or notice from the Czech national CERT has been published. Every detail below comes from the attacker's claims as QPulse reported them, and none of it has been independently verified.
What Happened
QPulse says the intrusion took place in September 2026. According to the listing, Incransom compromised the firm's entire Active Directory forest. That forest spans 10 domains and 3,338 objects, including 156 privileged administrator accounts. The group says it pulled out the krbtgt account, Domain Admin password hashes, AES-256 Kerberos keys and PKI certificates. If true, the attackers could forge authentication tickets anywhere in the forest whenever they like.
The group also claims it reached the firm's Veeam backup environment and its core business systems: Microsoft Dynamics CRM, Dynamics NAV ERP, SharePoint and Exchange/Microsoft 365.
There is a second claim in the region to note. Siberpol reports that a different group, Qilin, listed Slovak financial services firm Partners Group SK on its leak site on September 7, 2026, which is the same month. Nobody has reported a link between the two incidents. Readers should not assume the two claims describe the same intrusion or that the two groups worked together.
What Was Taken
QPulse lists the following data as claimed by Incransom:
- 1,324,203 client call recordings from 2008 to 2021. These are conversations about mortgages, investments, insurance and pensions, together with caller IDs and personal financial details.
- The client SQL database, said to hold full financial histories and personal data.
- Backup infrastructure: 15 production server images, at least 7 NAS repositories, and credentials for Azure Cloud Connect and VMware vSphere.
- Identity material: krbtgt, Domain Admin hashes, AES-256 keys and PKI certificates.
The call count is a single figure from a single report, and it has not been confirmed by the company or any authority. Voice recordings of financial advice are especially sensitive. They capture clients' voices, details of their finances and the way they talk to their adviser. All of that could help attackers clone voices and run convincing impersonation scams.
Why It Matters
Incransom has been listing financial firms in several countries in quick succession. Siberpol reports the group claimed about 500 GB of data from Colina Financial Advisors in the Bahamas in June 2026. In that listing, Incransom accused the firm's executives of trying to hide the breach. Breach House indexed a separate Incransom listing for Spain's fidepartners.com on November 3, 2026. That firm had not disclosed anything a week later. The pattern suggests the group goes after advisory firms because they hold a lot of client data and face heavy regulatory pressure.
Other recent cases show how long it can take before customers are told. Dapeer Law notes that US firm FAS Wealth Partners discovered its breach in February 2026 but sent notices about nine months later. Partner Colorado Credit Union only notified members in October 2026 about a vendor breach from late 2025. SMBC's leak through its email provider Arara shows a quieter risk: harvested contact data gets used for impersonation phishing. Clients of Partners Financial Services should expect the same kind of follow-on fraud if the recordings and contact data are real.
The Attack Technique
The way in has not been reported. The claimed outcome follows a familiar ransomware pattern. The attackers escalate to domain admin, take over the backup system so the victim cannot restore cleanly, and steal data before or instead of encrypting it for double extortion. If the krbtgt and PKI material really was taken, the attackers could forge Kerberos tickets and certificates. Resetting user passwords would not remove that access. The firm would have to rebuild trust across the whole forest.
What Organizations Should Do
- Reset krbtgt twice with enough time between resets for replication. Rotate every privileged account and service account across all domains in the forest.
- Revoke and reissue PKI. Treat any CA whose keys may have been exposed as compromised. Check for rogue certificate templates and for enrolment abuse of the ESC1 to ESC8 type.
- Isolate backups. Keep Veeam and similar backup servers out of the production domain. Require MFA on backup consoles. Keep immutable or offline copies. Rotate cloud connector and hypervisor credentials.
- Review how long call recordings are kept. Recordings from as far back as 2008 should be archived offline or deleted where regulations allow. Encrypt the stores where they are kept.
- Prepare clients for voice and phishing fraud. Tell clients how the firm will and will not contact them. Set call-back checks for any request to move money.
- Watch leak sites for your vendors and sister companies. Group-linked firms in other countries may be exposed through shared infrastructure.
Sources: Incransom Group Exfiltrates Active Directory Forest and 1.3 Million... | Colina Financial Advisors listed on incransom leak site | fidepartners.com — INCRANSOM Ransomware Attack Breach House | Partners Group SK listed on Qilin ransomware leak site | FAS (FAS Wealth Partners) Data Breach Letter (2026) | Partner Colorado Credit Union Data Breach Lawsuit - Class Action U | Bank, brokerage and mortgage breach notices: what financial firms t... | SMBC reports email address leak via third-party service The Paypers