PwC says it is aware of a cybersecurity incident at a third-party vendor that hosts employee learning records. The extortion group Everest says it has 590 gigabytes of the firm’s files. Only the first of those statements has come from anyone with a stake in being accurate.
What PwC says
A global spokesperson said the firm acted promptly to secure the environment and began a thorough review. The affected site held no client data, no sensitive personal information and no financial records, PwC said, and its own network and operations were untouched. The spokesperson declined to comment on Everest’s credibility or the volume of material involved.
The detail that matters is what the statement leaves out. It does not name the vendor, say how many employees appear in the records, or concede that anything left the building. An “incident” can be a lot of things.
What Everest says
According to the tracker eCrime.ch, Everest posted its claim on October 22. It lists regional HR records, exports of learning data, software components, e-learning courses and documentation on system integration. A countdown timer gives PwC five days before publication.
Timers are the standard lever for dragging a target into private talks, and they prove nothing about what the attackers hold. Extortion crews like big numbers because size is leverage, whether or not every file is worth anything.
The technical reality, so far, is a set of figures from third parties. Hackmanac’s alert describes 108,426 files taken from internal HR and learning systems. A leak-site listing names a directory, pwc-stg.csod.com, and Cornerstone OnDemand platform material, with 494 directories, 1,333 original archive containers and 53 nested ones. Hackmanac says the data covers PwC operations in Australia, China, Canada and the UK, and that one HR dataset holds 213,084 records. That is not a headcount: the number of unique people is unknown. The alert also mentions single sign-on source code and configuration files, but nothing shows whether working passwords or tokens are among them. Nor does the listing say how the material was obtained.
Why a training site matters
Everest also claims the haul includes staff records: roles, career histories, names, email addresses, phone numbers and home addresses. Security specialists note that such material could feed targeted social engineering, with criminals posing as HR staff, colleagues or executives and sending convincing mail about mandatory training to harvest logins. As ever, that is a risk, not a record of harm. Nothing indicates any of the alleged employee details have been circulated or used for fraud.
Everest’s history
The group has used theft claims to pressure named targets before, including an alleged breach of McDonald’s India. Its past includes both data extortion and file encryption. A separate technical analysis of Everest ransomware found no data-theft function in one encryptor it examined, though researchers noted theft could happen earlier with different tools. That finding says nothing definite about this case.
For now the open questions are whether the data is genuine, whose it is, how far the access went and whether any of it is current.
Sources
- PwC Confirms Cybersecurity Incident as Everest Claims Theft of 590 GB of Company Data
- PwC Vendor Breach: Everest Claims 590 GB [2026]
- PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data
Photo: PiDatacenters (CC BY-SA 4.0)
