Z-BL4CX-H4T Defaces Sumit CRM: 6 Indian Bank Records Exposed

Hacktivist group Z-BL4CX-H4T pushed a defacement page onto an address under app.sumit.co.il, the application subdomain of Israeli cloud accounting provider SUMIT. A second post from the group followed, carrying a spreadsheet of Indian bank details labeled “Indian Bank ExPosE.” The channel post with the page had drawn 39 views by the time of the screenshot, and the browser capture shows the page loading from a CRM file path.

CyberAsia reviewed two images on 17 October 2026. This report sticks to what they show, because CyberAsia found no public statement from SUMIT or any bank named in the sheet at the time of writing.

What the Z-BL4CX-H4T Defacement Page Shows

The forwarded post pairs a small preview image with the caption “HACKED BY Z-BL4CX-H4T” and a long link on the app.sumit.co.il domain. The path starts with /crm/downloadfile/ and ends in a random identifier. CyberAsia left that identifier out on purpose, since a live link would only send readers to the group’s content.

Opened in a mobile browser, the page is plain. It has a bold headline with an expletive aimed at Israel, a bordered box reading “YOUR SITE HAS BEEN HACKED” followed by an insult that is partly masked in the capture, and a footer line, Z-BL4CX-H4T-@2026. There are no images, no ransom note and no contact details. That bare template fits hit-and-run defacements, where the goal is a visible trophy rather than lasting damage.

The address bar is the strongest evidence in the set, since it shows the page rendering on a SUMIT-owned hostname rather than a mirror or look-alike domain.

The “Indian Bank ExPosE” Spreadsheet

The second post is an 81.2 KB image of a spreadsheet with the caption “Indian Bank ExPosE” and a single heart reaction. The columns read Bank Name, Account No, Account Name, Bank Address, Bank City, City Code, IFSC Code and Bank Detail Type.

Six rows are legible. They list Kotak Mahindra Bank, UCO Bank and ICICI Bank, with New Delhi addresses and city codes including 110018 and 110050. Two account names are visible, TripBuddy and Indian Holidays, and both read like travel businesses. Each bank appears twice, once tagged B2B and once tagged B2C. Account numbers and IFSC codes are blacked out in the image CyberAsia reviewed.

Nothing in the images ties this sheet to SUMIT’s systems. The group posted both items back to back, but the table could come from another source. As presented, it resembles payment account details for business customers, the kind of record a billing tool might hold. That is an interpretation, not something the screenshots establish.

What Is SUMIT and Why the CRM Path Matters

SUMIT, formerly known as OfficeGuy, is an Israeli software company founded in 2013. Its cloud platform handles invoicing, receipts, expense tracking, payment pages, credit card clearing and customer management. The product is built from modules, and the customer module works as the built-in CRM. The company’s official site is sumit.co.il.

That context explains why a defacement here matters beyond reputation. A billing and CRM platform stores client lists, invoices and payment settings for many tenants at once, so a flaw on one shared host can touch more than one company.

The /crm/downloadfile/ path hints that the page came through a file-serving function. One reading is that someone stored attacker-controlled HTML under a customer account and the platform returned it from its own domain. Another is a server-side change by someone with deeper access. Two screenshots cannot separate these.

Evidence Gaps in the Z-BL4CX-H4T Posts

Three questions stay open. The screenshots do not show how the page was placed, whether through a software flaw, a stolen login or a loose upload setting. Nothing connects the bank sheet to SUMIT data, and the sheet could be recycled from an older leak. And the group has shown no record count or sample large enough to judge scale, since only six rows appear.

Treat the sheet as sensitive anyway. Bank names, account holders and branch addresses can feed phishing and payment diversion fraud.

Who Is Z-BL4CX-H4T?

The group’s emblem is a gold line drawing of a figure in a fedora and trench coat inside a circle, with the handle on a banner across the bottom. The spelling swaps letters for numbers, a habit common among hacktivist crews. The “@2026” in the defacement footer reads as a year tag, and the headline names Israel as the target.

Beyond that, CyberAsia has no confirmed information on the group’s membership, location or history, so this report does not tie it to any state or movement.

Recommended Steps After a Defacement and Data Post

SUMIT customers should treat recent account activity with suspicion until the company says more. Practical steps:

• Reset passwords and switch on two-factor authentication for every user, starting with administrators and accounting firm staff.
• Review recent file uploads, shared links and API keys in the CRM module, and revoke anything unfamiliar.
• Check payment pages and clearing settings for changed redirect addresses or bank details.
• Tell clients and suppliers to confirm any request to change bank details by phone before sending money.

Indian businesses that recognize their names in the sheet should alert their banks and report the incident to CERT-In. Readers following other attacks on Israeli commerce can also read CyberAsia’s report on RipperSec’s attack on retailer BUG.

FAQ

Q1 : Was SUMIT itself breached?

The screenshots show a defacement page loading from a SUMIT hostname, which points to access or abuse of a platform feature. They do not show whether customer records were touched. Only SUMIT can answer that after reviewing its logs.

Q2 : Is the Indian bank data real, and who is affected?

That cannot be confirmed from an image with the sensitive fields blacked out. The visible rows name three banks and what look like two travel businesses in New Delhi. Treat the businesses as potential fraud targets and the banks as notification points, not as breached parties.

Q3 : What should SUMIT customers do right now?

Rotate credentials, enable two-factor authentication, audit uploaded files and API keys, and verify every payment detail change by phone. Keep a record of unexpected logins or modified payment pages for the company and the authorities.

Q4 : Can visiting a defaced page infect a device?

The page seen here looks like static text, so the immediate risk appears low. Defacements can still carry hidden scripts, which is why CyberAsia does not publish the live address.

Research Notice

This article is written for cybersecurity education and research. CyberAsia does not host, distribute or link to content posted by the group and does not encourage unauthorized access to any system. Details come from screenshots and public information at the time of writing and may change as SUMIT or other parties respond.