Sources checked: 21 September 2026.

Partners Financial Services has been named in connection with INC Ransom. An attacker-controlled listing does not, by itself, establish responsibility. In this case, there is a more substantial source: the company's own disclosure of access to client data. Source: Partners client notice (PDF)

What the company has confirmed

Partners Financial Services says it detected the attack on 23 August 2026. Attackers accessed encrypted personal data; the company assumes decryption may be possible. Its maximum potential scope includes identity, contact and contract information, older call recordings and, for some products, supporting documents. These are potentially affected categories, not confirmed contents of every affected record. Source: Client notice (PDF)

Partners Banka explicitly states that neither the bank nor its banking systems were affected. Partners Financial Services and Partners Banka should therefore not be treated as interchangeable names. Source: The bank's statement

The incident also has a Slovak dimension. The group's statement of 28 August names the Slovak advisory company Simplea Financial Services among those affected. At the time of that statement, the scope was still being assessed and clients were being informed progressively. This does not establish that every client was affected to the same extent. Source: The group's Slovak statement (PDF)

What the September INC Ransom listing means

GalaxyWarden gives 16 September 2026 for the Partners Financial Services listing on INC Ransom's site and labels it an unverified claim. However, the RansomLook screenshot displays 11 September 2026 beside the post. The sources therefore give different dates; neither, by itself, establishes when the attack took place. These links are not two independent confirmations: both point back to an attacker claim. Sources: GalaxyWarden, RansomLook screenshot

GalaxyWarden's assertion that the company had not publicly confirmed an incident is inconsistent with the August disclosures we found. However, the company statements we reviewed do not identify INC Ransom as responsible. We therefore do not describe the listing as a new September attack or as proof of a connection to the August incident.

Domains and systems according to INC Ransom

The following list is an unverified attacker claim, as captured in a RansomLook screenshot. Source: RansomLook screenshot

Listed domains: partners.cz, pfs.local, simplea.cz, simplea.sk, rentea.cz, partnersis.cz, nextpagemedia.cz, merity.cz, simplea.pl and penize.cz.

Listed systems and data:

  • Identity: Active Directory.
  • Client information: SQL databases and call archives.
  • Business applications: Microsoft Dynamics CRM/NAV, SharePoint, Kofax, Exchange/Microsoft 365.
  • Backups and infrastructure: Veeam, VMware vSphere, Proxmox, Dell PowerStore and cloud backups.
  • Network security: Check Point.

The screenshot presents these names as Active Directory domains. This does not confirm a compromise of public websites or DNS.

What clients should take away

A convincing scam is the most practical concern. Someone who knows your name or a product you use is not necessarily your adviser. Knowing those details does not authenticate the caller.

  • Verify unexpected calls through a contact you already trust or an official website you open yourself. Do not rely on a number or link supplied by the caller.
  • Do not disclose verification codes or approve payments or sign-ins simply because someone claims to be handling this incident.
  • If you have already shared credentials or approved a suspicious operation, contact the provider of the affected service immediately.
  • Ask the relevant company about the impact on your information. The absence of a notification does not, on its own, establish that your data was unaffected.

Lessons for businesses

Service availability and data protection are separate questions. Incident communications need to explain both: whether customers can use the service and what may have happened to their information.

From our perspective, useful preparation includes a procedure for verifying client requests after an incident, rules for notifying affected people, and consistent answers for support staff and advisers. Confusion about which company was affected can itself help a convincing scam.

This recommendation is not a forensic conclusion about the cause of the attack. The public sources we reviewed do not establish the entry point, the complete scope of the data or the attacker's identity.