Everest Ransomware Group Claims Theft of 590GB of PwC Data
The Everest ransomware group has alleged the theft of approximately 590GB of data from PwC, one of the Big Four professional services firms. The claim, posted on October 22, 2026, involves internal human resources and learning systems, though it remains unverified by independent sources.
According to a leak site screenshot, the dataset labeled “pwc.com 590 GB Database” includes 108,426 files across 494 directories and 1,386 archive containers. The alleged stolen data encompasses employee records, employment and training information, confidential audit documents, and single sign-on (SSO) source code. The listing also references the domain pwc-stg.csod.com, associated with PwC’s Cornerstone OnDemand learning platform, along with regional HR datasets from Australia, China, Canada, and the UK. One HR dataset reportedly contains 213,084 records, though the number of affected individuals remains unclear.
The leak site features a countdown timer, warning that the files will be published if PwC does not engage with the attackers. However, no evidence confirms whether the data is authentic, whether systems were encrypted, or if business operations were disrupted. The initial access vector, exploited vulnerabilities, and indicators of compromise also remain unidentified.
While monitoring services recorded the Everest group’s claim on October 22, 2026, the incident is currently classified as an alleged extortion attempt rather than a confirmed breach. Key questions including the data’s legitimacy, the affected legal entities, and whether production environments were accessed remain unanswered pending further investigation.
Source: https://gbhackers.com/pwc-allegedly-hit-by-everest-ransomware/
PwC TPRM report: https://www.rankiteo.com/company/pwc
"id": "pwc1792736838",
"linkid": "pwc",
"type": "Ransomware",
"date": "10/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Accounting, Consulting, Audit',
'location': 'Global (with regional datasets from '
'Australia, China, Canada, and the UK)',
'name': 'PwC',
'size': 'Large (Big Four firm)',
'type': 'Professional Services Firm'}],
'data_breach': {'data_exfiltration': 'Alleged (590GB of data)',
'file_types_exposed': ['Archive containers (1,386)',
'Mixed (108,426 files across 494 '
'directories)'],
'number_of_records_exposed': '213,084 records in one HR '
'dataset (total unclear)',
'personally_identifiable_information': 'Yes (employee '
'records)',
'sensitivity_of_data': 'High (PII, confidential business '
'documents, SSO source code)',
'type_of_data_compromised': ['Employee records',
'Employment and training '
'information',
'Confidential audit documents',
'Single sign-on (SSO) source '
'code']},
'date_detected': '2026-10-22',
'date_publicly_disclosed': '2026-10-22',
'description': 'The Everest ransomware group has alleged the theft of '
'approximately 590GB of data from PwC, one of the Big Four '
'professional services firms. The claim involves internal '
'human resources and learning systems, though it remains '
'unverified by independent sources. The dataset includes '
'employee records, employment and training information, '
'confidential audit documents, and single sign-on (SSO) source '
'code. The leak site features a countdown timer, warning that '
'the files will be published if PwC does not engage with the '
'attackers.',
'impact': {'data_compromised': '590GB of data allegedly stolen',
'identity_theft_risk': 'Potential risk due to employee records and '
'PII exposure',
'systems_affected': 'Internal human resources and learning '
'systems, Cornerstone OnDemand learning '
'platform'},
'investigation_status': 'Ongoing (alleged extortion attempt, unverified)',
'motivation': 'Extortion',
'ransomware': {'data_exfiltration': 'Alleged (590GB of data)',
'ransomware_strain': 'Everest'},
'references': [{'date_accessed': '2026-10-22',
'source': 'Everest ransomware group leak site'}],
'threat_actor': 'Everest Ransomware Group',
'title': 'Everest Ransomware Group Claims Theft of 590GB of PwC Data',
'type': 'Ransomware'}