PwC confirms cyber incident at vendor hosting employee learning records

PwC confirmed the incident on 23 October 2026, a day after Everest posted its allegations, and said the affected site did not house client data, sensitive personal data or financial information. "Once we learned of this incident we acted promptly to secure the environment and conduct a thorough review," a PwC global spokesperson said. The firm said the incident did not affect its own network or operations.

The identity of the vendor has not been disclosed. PwC declined to comment on the amount of information allegedly stolen or on whether Everest's statements accurately represented the contents of the affected system, Beinsure reported. The confirmation establishes that an incident occurred at an external provider, but does not substantiate the theft of 590 GB or the categories of data Everest describes.

Everest's claim

Everest listed PwC, one of the Big Four professional services firms, on its leak site on 22 October 2026, Beinsure reported, citing cybercrime research platform eCrime.ch. The group claimed 590 GB of data comprising regional HR and learning exports, integration documentation, software components and PwC e-learning courses. It said the material included information about individuals and their organisational and employment history, including names, email addresses, telephone numbers and physical addresses. Those descriptions have not been independently verified.

GBHackers reported that the leak-site screenshot described a dataset labelled pwc.com 590 GB Database at 590.69 GB across 108,426 files in 494 directories, plus 1,386 archive containers holding 19,324 files. The listing shows 1,333 original archive containers and 53 nested containers, the same 1,386 total. The screenshot alone does not establish how the material was obtained.

Hackmanac attributed the alleged data to PwC operations in Australia, China, Canada and the UK, including one HR dataset of 213,084 records, GBHackers reported. That figure does not establish how many unique people appear in the dataset. Everest's posting carried a countdown with about five days remaining and a warning that the files would be published if no agreement was reached. Cybersecurity News reported a 28 October release deadline, which has not been independently confirmed.

Cybersecurity News reported that no ransom amount, initial access method or evidence of encrypted PwC systems has been established in the reviewed material, and that Everest has used data theft claims to pressure named organisations before, including an alleged McDonald's India breach.

What the claim covers

The claimed material mixes two kinds of data, Shattered reported. Software components and integration documentation describe how a learning platform connects to other systems, while HR and learning exports point to records about staff and training histories. PwC says the affected site held no sensitive personal data; Everest claims it took employee records. The two statements are not in direct conflict because they describe different things.

VARIndia reported no independently verified evidence that active credentials, encryption keys or operational authentication tokens were compromised. It noted that HR applications and learning platforms process employee information while maintaining integrations with identity-management systems, and that a supplier incident can draw scrutiny of a consulting firm even when core systems stay secure. Cybersecurity News noted that detailed employee records could help criminals craft convincing phishing messages or impersonate staff.

The vendor clue

The leak-site screenshot names a directory, pwc-stg.csod.com, and describes Cornerstone OnDemand platform materials, GBHackers and Cybersecurity News reported. Researchers associate that hostname with Cornerstone OnDemand's learning-management technology, VARIndia reported. Cloudskope identified a staging environment associated with that platform. That does not establish how an intruder got in or prove that Cornerstone's production infrastructure was breached.

PwC's public statements do not say how many employees appear in the learning records.

What remains open

Beinsure reported that PwC continued investigating the claims as of 26 October. Cybersecurity News reported that the central questions remain the data's authenticity, ownership, access scope and whether any records are current.