Follow Beinsure
PricewaterhouseCoopers (PwC) has confirmed a cybersecurity incident involving an external vendor that hosts employee learning records, after the Everest cyber extortion group claimed to have stolen 590 gigabytes (GB) of company data, including human resources information, internal documentation and training materials.
The global professional services firm acknowledged the incident on October 23, 2026, a day after Everest posted its allegations on a data leak website. PwC said it had taken steps to secure the affected environment and was reviewing the incident, but declined to confirm whether the group had obtained the reported volume of information.
- PwC confirmed a cybersecurity incident involving a third-party provider hosting employee learning records, following Everest’s claim that it stole 590 GB of company data.
- The Everest extortion group threatened to publish allegedly stolen HR information, employee contact details, software components and training materials unless an agreement was reached.
- PwC said its internal network and operations were unaffected and that the vendor platform did not contain client data, sensitive personal information or financial records.
A PwC global spokesperson said the affected platform did not contain client information, sensitive personal data or financial records.
The affected site does not house client data, sensitive personal data or financial information. Once we learned of this incident we acted promptly to secure the environment and conduct a thorough review.
The company also stated that the incident “does not impact our network or any of our operations,” the spokesperson said.
PwC continued investigating the claims as of October 26, according to subsequent reporting. The identity of the affected third-party vendor has not been disclosed.
Everest claims to have stolen 590 GB of PwC data
The Everest group claimed responsibility for the alleged breach in a message published on its website on October 22, according to cybercrime research platform eCrime.ch.
The posting included a countdown timer showing five days remaining, accompanied by a warning that the information would be released publicly if an agreement could not be reached.
Everest claimed to possess 590 GB of information comprising “regional HR and learning exports, integration documentation, software components and PwC e-learning courses.”
According to the group, the material also contained information about individuals and their organisational and employment history.
The allegedly compromised records included names, email addresses, telephone numbers, physical addresses and other personal details. These descriptions have not been independently verified. PwC declined to comment on the amount of information allegedly stolen or whether Everest’s statements accurately represented the contents of the affected system.
The distinction is significant because PwC has explicitly stated that the vendor platform did not store sensitive personal data, financial information or client records, while Everest has claimed access to employee-related information.
The company’s confirmation establishes that a security incident occurred at an external provider, but does not independently substantiate the alleged theft of 590 GB or the specific categories of information described by Everest.
PwC says internal systems and operations remain unaffected
PwC said the cybersecurity incident was confined to a third-party environment used to store employee learning records rather than its internal corporate network.
According to the company’s statement, the affected external platform did not house client data, sensitive personal information or financial records. PwC also reported no disruption to its business operations.
Following discovery of the incident, the company said it acted promptly to secure the affected environment and undertake a review.
The available statements do not establish how the external system was compromised, how many individuals may have been affected or whether attackers successfully removed the information they claim to possess.
The incident nevertheless raises questions about the security of corporate information stored by external technology providers, particularly systems that support employee training and human resources administration.
PwC has not publicly identified the vendor involved or confirmed whether the alleged data exposure extends beyond employee learning records.
Such platforms can operate outside an organisation’s primary IT infrastructure while maintaining information associated with employees and internal business processes.
In this case, PwC has distinguished the external vendor incident from any compromise of its own network, and there is no confirmed evidence in the company’s statements that its central systems were breached.
Everest has previously targeted critical infrastructure providers
Everest is an established cyber extortion and ransomware group that has previously been associated with attacks against organisations operating in critical infrastructure and other industries.
According to cybersecurity research published by Halcyon, the group emerged in late 2020 and has operated as an initial access broker, providing compromised credentials to other cybercriminal organisations.
Researchers have also documented attempts by Everest to recruit insiders, offering cash payments and profit-sharing arrangements in exchange for assistance.
The group has claimed responsibility for attacks involving critical infrastructure providers across multiple countries.
In 2025, Everest claimed involvement in attacks affecting several international airports through an incident targeting aerospace technology provider Collins Aerospace.
Those activities form part of the group’s documented history, although its allegations concerning PwC remain unverified.
The October 22 posting followed a familiar extortion pattern in which attackers claim possession of confidential information and threaten publication if their demands are not met.
In the PwC case, the posting’s five-day countdown was presented alongside the group’s warning that the allegedly stolen material could be released if negotiations failed.
Neither the existence of an agreement nor any response to the group’s demands has been confirmed.
Investigation continues into third-party employee records incident
PwC’s response has focused on securing the affected vendor environment and reviewing the circumstances of the incident.
The company has not verified Everest’s claimed 590 GB data theft, disclosed the number of potentially affected employees or identified the specific systems and records involved.
It has also not reported any impact on client information, financial records, internal network infrastructure or normal business operations.
The incident places attention on third-party cybersecurity exposure, particularly where external platforms hold employee records and supporting technical documentation.
For PwC, the principal unresolved questions concern the extent of any unauthorised data access, the authenticity of Everest’s claimed files and whether information associated with individuals was actually obtained.
As of October 26, the company’s confirmed position remained that an incident had occurred involving an external provider, its own network and operations were unaffected, and the allegations made by Everest had not been substantiated.
