# PARTNERS FINANCIAL SERVICES, a.s. — DATA BREACH **Date:** September 2026 **Target:** Partners Financial Services, a.s. (IČO: 27699781) **Location:** Prague, Czech Republic **Industry:** Financial Services / Banking / Insurance --- ## WHO IS PARTNERS? Partners Financial Services is the **largest independent financial advisory and brokerage firm in the Czech Republic**. Founded in 2007, the group has grown to include: - **Partners Banka** — a fully licensed bank (ČNB license, launched March 2024) - **Partners investiční společnost** — investment fund management (7.2 billion CZK AUM) - **Simplea pojišťovna** — life insurance company (64,000+ clients) - **Rentea penzijní společnost** — pension fund (2 billion CZK AUM) - **Trigea nemovitostní fond** — real estate fund (3.7 billion CZK AUM) - **NextPage Media** — Peníze.cz, Finmag, Heroine.cz **Revenue:** >3 billion CZK/year (~€120M) **Assets Under Management:** ~13 billion CZK (~€520M) **Financial Advisors:** 2,000+ **Branches:** 170+ across Czech Republic **Clients:** 300,000+ Ownership: **Petr Borkovec** (CEO, 49%) and **Radim Lukeš** (co-founder, 36%). --- ## WHAT WAS COMPROMISED ### 1. COMPLETE ACTIVE DIRECTORY FOREST — 10 DOMAINS The entire AD forest was extracted including full NTDS.dit: | Domain | Accounts | Entity | |--------|----------|--------| | partners.cz | 888 | HQ — Partners Financial Services | | pfs.local | 708 | Core internal domain | | simplea.cz | 132 | Simplea insurance | | simplea.sk | 38 | Simplea Slovakia | | rentea.cz | 36 | Rentea pension fund | | partnersis.cz | 36 | Partners investment company | | nextpagemedia.cz | 4 | NextPage Media | | merity.cz | 3 | Merity fund | | simplea.pl | 1 | Simplea Poland | | penize.cz | 1 | Peníze.cz media | **Total: 3,338 AD objects — 1,856 users — 1,482 computers — 156 privileged admins** Golden Ticket material (krbtgt) extracted — permanent forest-wide access. Domain Admin hash + AES-256 keys + Kerberos TGT + PKI certificate with private key. ### 2. 1,324,203 CLIENT CALL RECORDINGS (2008–2021) Thirteen years of recorded phone conversations from the Partners call center: - **1,324,203 WAV files** with **1,323,829 unique caller IDs** - Clients discussing **mortgages, investments, insurance, pensions** - Contains: client voice, phone numbers, full financial details - Period: **2008 to 2021** (~130,000 recordings per year at peak) This is **maximum GDPR-sensitive data** — financial conversations of hundreds of thousands of Czech citizens. ### 3. CLIENT DATABASE (SQL) - **ClientHistory** — full client financial history (PII) - **Anonymizace** — GDPR anonymization pipeline (proves they know this data is sensitive) - Production AlwaysOn Availability Group (Cluster036) — full/diff/log backups from August 2026 ### 4. VEEAM BACKUP INFRASTRUCTURE - **15 production server images** (full .vbk backups, restorable) - **7+ NAS repositories** across multiple sites - **VMware vSphere** full admin access (vsphere.pfs.local) - **Azure Cloud Connect** — off-site backup credentials - **DELL PowerStorage** — storage infrastructure - **Proxmox** — secondary hypervisor - Backup period: November 2023 to August 2026 ### 5. COMPLETE IT INFRASTRUCTURE - Microsoft Dynamics CRM (client data) - Dynamics NAV ERP (financial operations) - SharePoint intranet (12 service accounts) - 188 IIS application pools - CheckPoint firewall - Kofax document management - Exchange/M365 email ### 6. CRACKED CREDENTIALS Passwords already cracked from the NTDS dump: ``` qwerqwer → 7 accounts (adkofax, OfficeZ, hrsit, DPokorny, vars, vratky, web) September2023 → simplea.sk\XVidrova dominik521 → pfs.local\DHutecka Neutrogena123 → partners.cz\KPtackova J1j2j3j4j5j6 → partners.cz\JKonicek Administrator77 → partners.cz\NAutratova ``` 3,325 additional hashes pending crack. --- ## DATA VOLUME | Category | Count | |----------|-------| | Call recordings (WAV) | 1,324,203 files | | AD objects | 3,338 | | NTLM hashes | 3,331 | | Kerberos keys | 12,470 | | VM backup files | 108 | | SQL backup files | 398 | | Veeam storage blobs | ~5,600 | | **Estimated total** | **~1.5–2.5 TB** | --- ## REGULATORY EXPOSURE Partners Financial Services operates under supervision of: - **ČNB (Czech National Bank)** — Partners Banka has a full banking license. This breach directly threatens that license. - **ÚOOÚ (Czech Data Protection Authority)** — GDPR breach with 1.3M client call recordings. Fine up to **4% of annual turnover (~€5M)**. - **GDPR Article 33** — Mandatory 72-hour breach notification to hundreds of thousands of affected clients. - **NBS (Slovakia)** — Simplea SK operations. Partners/Borkovec chairs **AFIZ** (Association of Financial Intermediaries and Advisors) — the industry body that is supposed to ensure standards. The company already received negative coverage on **Černé ovce (ČT, 2025)** for advisor misconduct. This breach proves systemic security failure. --- ## PROOF Screenshots and sample data available. We can provide: - Any 10 files from the 1.3M+ file tree on request - NTDS dump samples with domain attribution - WAV recordings with caller IDs - Veeam job metadata proving backup infrastructure access - SQL database headers --- ## TIMELINE Partners Financial Services was given the opportunity to resolve this matter privately. Their response determines next steps. --- *Partners Financial Services, a.s. | Türkova 2319/5b, 149 00 Praha 4 | IČO: 27699781*