Horizon Tech / X24 Intel workspace hosts BCG credentials — HRPM-DTH20160 corpus update

## Summary On 13 July 2026 we ingested a second wave of evidence into case **HRPM-DTH20160**: - **3 PDF email threads** (hashed with SHA-256, custody_status = HASHED): - *KKS-BCG-PBCL Contract* — 30-message 2016 thread where irfan@backcheckgroup.com dispatches a BCG-to-Pakistan Beverages & Cans Ltd contract at Rs.5,000+tax/case with kks@backcheckgroup.com, Xcluesiv finance and Norren Da (imran@backgroundcheck.email) on CC. - *KKS-BCG Job Confirmation* — 41-message 2016 HR grievance chain where Munam Shah (Xcluesiv Pte Ltd, 30 Cecil St, Singapore) escalates to hr@backcheckgroup.com; KKS, Irfan Haq and Athar Khan are copied on the management chain. - *KKS still CC-listed in 2020* — 10 Jul 2020 i2c Pakistan cheque intimation (#39544176 BAF, Rs.74,851) to BCG finance with kks@ and ceo@backcheckgroup.com on CC. - **6 OSINT screenshots** (Google Drive / Google Sheets, same-night capture at ~03:37–03:45 AM PKT) showing: - **BCG ICT Passwords Master File (Horizon).xlsx** plus duplicate `.xlsx`, Carbonio Account `.csv` exports and a `sheets` folder, all authored by *"X24 Intel"* on 31 May 2026. - Google Sheets search for **`Ovh proxmox`** surfacing "BCG ICT Passwords Master File" (Danish Iqbal, Jul 11), "BCG PasswordSheet" (Rasheed Ahmed, Jul 1) and "BCG New Credentials" (IT Support, May 4). - Google Docs search **`asad mahmood`** returning "Forensic Investigation Analysis", "EXECUTIVE INSIDER THREAT BRIEFING", "BACKGROUND CHECK GROUP — FORENSIC" dossier and multiple "Investigative Briefing" docs authored by Danish Iqbal (Jun 15–Jul 12 2026). - Drive query **`owner:asadmahmood@horizontech.biz`** returning *BCG-Daily Complain Log* (M. Asad Mahmood, Feb 22 2022) — binding the horizontech.biz identity to a BCG operational log. - The **BCG-Daily Complain Log Share dialog** confirming *General access = Horizon Tech (Viewer)*. - **Recent Activity** panel on 13 Jul 2026 showing the same credential and log files opened minutes before capture. ## Why this matters Taken together, these artefacts document three independent bindings: 1. **Khalid K. Siddiqui (kks@backcheckgroup.com)** sat inside BCG commercial, HR and finance distribution lists from **2016 through at least July 2020** — well past any claimed disengagement. 2. **Horizon Tech (horizontech.biz)** is not a neutral workspace: it hosts BCG's ICT password master file, mail-account exports and an internal insider-threat forensic workstream in parallel to (and outside of) any independent investigation. 3. **X24 Intel** appears as the authoring identity on the exported BCG credential and Carbonio files — a third-party brand extracting BCG credentials into Horizon-Tech-hosted spreadsheets. ## Evidence handling Every file was SHA-256 hashed prior to upload, stored in the `evidence` bucket under `HRPM-DTH20160/2026-07-13/` and registered in `evidence_uploads` with `custody_status = HASHED`. The 6 OSINT screenshots additionally land in `dark_web_artifacts` with structured entity extraction; 4 new dated events and 4 new canonical entities (M. Asad Mahmood, Horizon Tech, X24 Intel, Imran Tariq) are linked to the case. The full annex PDF with hashes and chain-of-custody is available at `/HRPM-DTH20160_v2.6_annex_2026-07-13.pdf`. *Framed as allegations under PPC / PECA / AMLA — verified against primary documents and OSINT capture.*