Severity
High
Analysis Summary
PwC has been named in multiple cybercrime forum and leak-site listings alleging the theft and exposure of substantial volumes of corporate and employee data. The Everest ransomware group claims to have stolen approximately 590.69 GB of data, comprising 108,426 files across 494 directories, allegedly originating from PwC's internal HR, employee-learning, and corporate training systems.
The exposed information reportedly includes employee personal details, employment and training records, internal audit methodologies, confidential corporate documents, SSO source code and configuration files, Cornerstone OnDemand materials, e-learning courses, integration documentation, and software components. The alleged exposure spans multiple regional operations, including Australia, China, Canada, and the United Kingdom. One HR dataset reportedly contains 213,084 records. The listing was observed on October 22, 2026, and remains pending verification.
PwC subsequently confirmed that a third-party vendor hosting employee-learning records had experienced a cybersecurity incident. However, the company stated that its internal network and business operations were unaffected and that the compromised platform did not contain client data, financial information, or sensitive personal data. PwC's confirmation establishes a security incident at the third-party learning vendor but does not validate Everest's claims regarding the volume or scope of stolen information.
Separately, another threat actor advertised approximately 260 GB of data allegedly stolen from PwC, including around 250 GB reportedly originating from its Azure cloud environment, 10 GB of personal data, and complete GitHub organization repositories containing source code. The dataset was reportedly offered for sale through an escrow service. This claim is unverified and is separate from Everest's earlier listing.
Both claims remain unverified in terms of the alleged data theft and their respective scopes. If genuine, the exposure of cloud data, source code, employee records, and internal documentation could create risks involving data confidentiality, intellectual property, and supply-chain security.
Impact
- Unauthorized Access
- Sensitive Information Exposure
- Reputational Damage
Remediation
- Conduct a thorough investigation to determine whether any internal systems, cloud resources, or third-party platforms were compromised.
- Review Azure access logs, audit trails, and security alerts for suspicious activities or unauthorized access.
- Rotate potentially exposed credentials, API keys, access tokens, and SSO secrets.
- Audit GitHub organization permissions and revoke unauthorized access to repositories.
- Review exposed source code for hardcoded credentials, API keys, and sensitive configuration details.
- Enforce Multi-Factor Authentication (MFA) across cloud environments, GitHub, and internal systems.
- Strengthen third-party vendor security assessments and require timely incident reporting.
- Monitor for leaked employee information, credentials, and corporate data across dark web sources.
- Implement Data Loss Prevention (DLP) controls to detect and prevent unauthorized data transfers.
- Ensure sensitive data is encrypted at rest and in transit.
- Apply least-privilege access controls across internal systems and cloud environments.
- Preserve relevant logs and forensic evidence to support incident investigation and response.