The INC Ransom extortion group (also written "Incransom") has added Shenwan Hongyuan (H.K.) Limited to its dark web leak site. QPulse reports that the group says it took 9.97 TB of data, about 21 million files. Shenwan Hongyuan (H.K.) is listed in Hong Kong (stock code 0218) and runs the overseas securities, investment banking and asset management business of the state-backed Shenwan Hongyuan Group. The company has not confirmed that any data was stolen. On 23 October 2026 it told the Hong Kong stock exchange that it had received a "suspected extortion message" from a sender who claimed to hold group information. It said it had reported the matter to the Hong Kong Police and that trading and settlement were running normally. The ransomware claim and the October message have not been officially linked. No figure in this brief has been independently verified.
What Happened
The story has two separate parts so far.
The company's disclosure (23 October 2026). According to the company's inside information announcement on HKEXnews, as reported by Polstob, Minichart and GMT Eight, the group "recently received a suspected extortion message" from a sender who claimed to have obtained certain group information and wanted a response. The company said it:
- switched on its IT cybersecurity emergency response process and carried out "multi-dimensional" security hardening;
- reported the incident to the Hong Kong Police Force and stayed in close contact with them;
- found that, as of the announcement date, its core operational and management systems, including trading and settlement, were "operating normally," with "no loss of customer assets or funds."
The company called this a preliminary assessment by management. It said it would make a further announcement if its investigation found a material impact on its finances or operations, and it told shareholders to be careful when trading its shares. Chairman and CEO Ma Xiaoyong signed the notice. As Polstob and Minichart point out, the notice did not say what information the sender claimed to have, whether customer data was involved, what the sender wanted, or whether any regulator other than the police was involved.
The leak-site listing (November 2026). Reports give different dates for when the listing appeared. Vulnpocalypse cites a RansomLook entry dated 10 November 2026. Undercode News says Dark Web Intelligence reported the listing on 12 November. QPulse published its detailed account on 13 November.
Reports also disagree about how much the group has published. Undercode News says the listing gives no record count, no sample of stolen data, no ransom deadline and no technical evidence of access. QPulse describes a detailed list of what the group says it took and which systems it says it controlled. Those claims may have been added after Undercode News looked, or they may come from material Undercode News did not see. Either way, every detailed figure below is the attacker's own claim, and none has been checked.
What Was Taken
Shenwan Hongyuan (H.K.) has not confirmed that any data was taken. The figures below are what QPulse reports from the group's claim.
Volume: 21,002,068 files, totalling 9.97 TB.
Scope: QPulse says the claim covers operations in Hong Kong, Singapore and a holding company in the British Virgin Islands. It names two Active Directory domains (SWSHKG and INT), four office locations and six branch offices. The company's website, cited by Polstob, also lists offices in London, Tokyo and Seoul. Nothing reported so far says whether those offices are affected.
Business and regulatory data claimed: - Eight months of live trading positions from the fixed income, currencies and commodities (FICC) desk - A derivatives portfolio with HKD 2.8 billion in net exposure - ISDA master agreements with 20 global investment banks - 22 straight quarters of PwC audit packages - Material from a 2024 on-site inspection by the Securities and Futures Commission (SFC) - Mailbox archives for 162 former employees, totalling 644 GB
Credentials and infrastructure claimed: - 1,091 computers compromised - 796 NTLM password hashes and 509 plaintext passwords - Six firewalls, five F5 load balancers, eight ESXi hypervisors and five SAN storage arrays - Admin access to the TPAM privileged access system, RSA Authentication Manager, PRTG monitoring, Kaspersky's admin console, Red Hat Satellite, production SQL Server "sa" accounts, Veeam Backup and Bomgar Remote Support
Neither the company nor any regulator has said whether client personal data is in the claimed files. Its own statement only rules out loss of customer assets or funds.
Why It Matters
If the claim is true, this is a full network takeover, not a single file grab. Control of privileged access, MFA servers, hypervisors, storage and backups at once would mean the attacker could sign in as anyone, reach any system and potentially destroy recovery points. QPulse rates the credential exposure as needing immediate company-wide password rotation. The company's statement that trading and settlement are normal does not contradict this. Many extortion groups steal data without encrypting anything.
Counterparties are exposed as well. ISDA agreements, trading positions and derivatives exposure describe the firm's relationships with other banks. If that material is leaked, it could reveal trading strategy and counterparty terms to competitors and fraudsters. The 20 banks named in the claim should treat it as relevant to them.
Regulators are directly involved. The claim includes SFC inspection files and audit papers. If those leak, they would put confidential supervisory correspondence into public view. Hong Kong's government InfoSec portal notes that financial services is one of the sectors most often hit by data breaches, and that cross-border data rules are getting stricter, including China's Personal Information Protection Law. Because the business spans Hong Kong, Singapore and offshore entities, more than one regulator may have a say if personal data turns out to be involved.
The company and the attacker tell different stories, and that matters. The company's 23 October wording, "a sender who claims to have obtained certain information," leaves the scope open. A listing with this much detail adds pressure. If the group publishes samples, the company may have to update the market under the same Hong Kong listing rules it used in October.
The Attack Technique
How the attackers got in has not been disclosed. The company has said nothing about the cause, and none of the reporting on this incident names an initial access method, a vulnerability or a phishing campaign.
What has been reported is what the group says it did after getting in: domain-wide credential theft (NTLM hashes and plaintext passwords), takeover of identity and privileged access systems (TPAM, RSA Auth Manager), control of virtualisation and storage (ESXi, SAN) and access to backups (Veeam). That pattern is typical of a long, patient intrusion. The claim of eight months of trading data suggests either long access to that data or a large archive taken in one go. The reporting does not say which.
INC Ransom has been active since 2023 and runs a double-extortion model: steal data first, then threaten to publish it. In past cases it has been linked to exploiting internet-facing appliances and to using stolen valid credentials. That history is background only. Nothing reported so far ties any particular technique to this incident.
What Organizations Should Do
- Assume privileged credentials are exposed after any extortion contact. If you receive an extortion message, rotate domain admin, service account, krbtgt (twice), hypervisor, firewall and PAM credentials straight away. Do not wait for proof of theft. The claimed plaintext passwords show how far reused credentials spread.
- Separate and harden your recovery systems. Keep Veeam and other backup consoles, ESXi management and SAN admin interfaces off the domain they protect. Require separate credentials and phishing-resistant MFA for them, and keep at least one immutable or offline backup copy.
- Treat PAM, MFA and remote-support tools as the most valuable targets. Check the logs of systems like TPAM, RSA Auth Manager and Bomgar or BeyondTrust for unusual sessions, new admin accounts and policy changes. Patch these tools first.
- Watch for large outbound transfers. Taking 10 TB out of a network takes time and bandwidth. Alert on sustained large uploads, unusual cloud storage destinations and archiving tools such as rclone, 7-Zip and WinRAR running on servers.
- Clean up dormant data. The 644 GB of former-employee mailboxes is a reminder to apply retention rules to departed staff's accounts and archives, and to remove access to old audit and regulatory files that nobody uses.
- Counterparties: get ready now. If your firm has ISDA or other agreements with Shenwan Hongyuan (H.K.), ask the company directly what it has found. Warn your staff about targeted phishing that uses deal details, and confirm any changes to payment or settlement instructions through contacts you already know.
Sources: Incransom Ransomware Group Exfiltrates 9.97 TB of Data from Shenwan... | INC Ransom Targets Shenwan Hongyuan (HK), Raising Questions Over a... | Inc Ransom claims Shenwan Hongyuan, unconfirmed Vulnpocalypse | Shenwan HK says suspected extortion message… · Polstob | Shenwan Hongyuan (H.K.) Discloses Suspected Extortion, Says Trading... | GMT EIGHT - Shenwan Hongyuan Group Hong Kong (00218): The Group's c... | InfoSec: Data Breach | 申万宏源（香港）、恐喝の疑いのあるメッセージを受信 送信者はグループの情報を入手したと主張 · Polstob