Everest claims 590 GB theft of PwC HR and training data; PwC confirms incident at third-party training-records vendor
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:02; os links antigos trazem para cá.
Fontes: olhardigital.com.br ↗ gbhackers.com ↗
The Everest extortion group listed PwC on its leak site on 22 October 2026, claiming 590.69 GB of stolen HR and learning data. On 23 October, PwC said it is aware of a security incident at a third-party vendor that hosts employee training records (olhardigital.com.br). A PwC global spokesperson said the affected environment holds no client data, sensitive personal information or financial data, and that PwC's internal network and operations are not affected. PwC has taken steps to protect the environment and started a review, but has not confirmed the volume of data or the validity of Everest's claims. The leak post carries a countdown of about five days and a threat to publish the files if no deal is reached. The claimed data volume and contents remain unverified, and the listing alone does not show that any systems were encrypted.
Detalhes técnicos
- The listing claims 590.69 GB across 108,426 files in 494 directories, labelled "pwc.com 590 GB Database". It also lists 1,386 archive containers holding 19,324 files (gbhackers.com).
- The claimed content includes employee records, training data, confidential audit documents and single sign-on source code (gbhackers.com). Everest also cites HR and training files, systems integration documentation, software components and digital learning courses (olhardigital.com.br).
- Everest says the material includes personal and professional histories, such as names, email addresses, phone numbers and home addresses (olhardigital.com.br).
- The directory "pwc-stg.csod.com" points to Cornerstone OnDemand learning platform material, regional HR exchanges, e-learning courses and integration testing and maintenance documents (gbhackers.com). The vendor's identity has not been disclosed (olhardigital.com.br), so the link to Cornerstone is an inference from the directory name only.
- Hackmanac attributes the data to regional operations in Australia, China, Canada and the United Kingdom, and notes one HR dataset with 213,084 records. That figure does not equal the number of unique individuals affected (gbhackers.com).
- The claim was recorded by monitoring services on 22 October 2026 (gbhackers.com) and reported via the cybercrime research platform eCrime.ch (olhardigital.com.br).
- The initial access vector, exploited vulnerabilities, malware payload and IOCs are not disclosed. The screenshot's capture date and deadline are unreliable (gbhackers.com).
- There is no independent confirmation that the full claimed volume was stolen or that the files come from compromised systems.
Remediação
No technical remediation guidance has been published. PwC says it has secured the affected environment and is investigating (olhardigital.com.br). PwC and its vendor should verify the scope of the exposure. Organizations with ties to PwC or Cornerstone OnDemand should watch for official statements and review their exposure to third-party HR and learning platforms (gbhackers.com). Anyone whose training or HR records were held by the vendor should be alert to targeted phishing (olhardigital.com.br).
Relatos divergentes
- Confirmation: The earlier report says no PwC statement existed and treats the claim as wholly unverified (gbhackers.com). The later report says PwC confirmed a third-party vendor incident on 23 October (olhardigital.com.br), which is more recent and more authoritative. PwC has still not validated Everest's specific claims.
- Scope: Everest's listing alleges confidential audit documents and SSO source code (gbhackers.com), while PwC says the affected environment holds no client data, sensitive personal information or financial data (olhardigital.com.br). Neither claim is independently verified.
- Affected environment: The earlier report says it is unclear whether PwC infrastructure, a service provider or another environment was accessed (gbhackers.com). PwC's statement points to a third-party vendor and says its own network is unaffected (olhardigital.com.br).
Linha do tempo
-
Everest extortion group claims 590 GB theft from PwC via third-party training records vendor
ler a análise desta fonte ocultar
PwC confirmed on 23 October 2026 that it is aware of a security incident at a third-party vendor that hosts employee training records. The day before, the Everest extortion group claimed to have stolen 590 GB of PwC data. A PwC global spokesperson said the affected environment holds no client data, sensitive personal information or financial data, and that the incident does not affect PwC's internal network or operations. PwC has taken steps to protect the environment and started a review, but has not confirmed the volume of data allegedly stolen or the validity of the claims.
Technical Details
- Everest posted the claim on its leak site on 22 October 2026, as reported by the cybercrime research platform eCrime.ch. The post includes a five-day countdown and a threat to publish the files if no deal is reached with PwC.
- The group says the data includes HR and training files, systems integration documentation, software components and digital learning courses.
- Everest also says the material contains personal and professional history of individuals, including names, email addresses, phone numbers and home addresses.
- There is no independent confirmation that the full claimed volume was stolen or that the files match content from compromised systems.
- The initial access vector and the vendor's identity are not disclosed.
Remediation
The article gives no remediation guidance beyond PwC's statement that it secured the affected environment and is investigating. PwC and its vendor should verify the scope of the exposure, and anyone whose training or HR records were held by the vendor should be alert to targeted phishing.
-
Everest ransomware group claims theft of 590GB of PwC HR and learning data in unverified extortion listing
ler a análise desta fonte ocultar
The Everest ransomware group has listed PwC on its leak site, claiming 590.69GB of stolen data across 108,426 files in 494 directories. The claim, recorded by monitoring services on October 22, 2026, is unverified, and no independent source or PwC statement has confirmed it. The alleged data covers internal HR and learning systems, including employee records, training data, confidential audit documents and single sign-on source code. The listing shows a countdown of about five days before publication, which suggests extortion leverage. The listing alone does not show that any systems were encrypted or that the files are authentic, so this should be treated as an alleged data theft and extortion claim rather than a confirmed ransomware compromise.
Technical Details
- The leak-site screenshot labels the dataset "pwc.com 590 GB Database" and also lists 1,386 archive containers holding 19,324 files.
- The directory "pwc-stg.csod.com" points to Cornerstone OnDemand learning platform material, regional HR exchanges, e-learning courses and integration testing and maintenance documents. This does not establish whether PwC infrastructure, a service provider or another environment was accessed.
- Hackmanac attributes the data to regional operations in Australia, China, Canada and the United Kingdom, and notes one HR dataset with 213,084 records. That figure does not equal the number of unique individuals affected.
- The initial access vector, exploited vulnerabilities, malware payload and IOCs are not disclosed. The screenshot's capture date and deadline are unreliable.
- Open questions: data authenticity, the affected legal entities, and whether any production environment was accessed.
Remediation
The article gives no remediation guidance. Defenders with ties to PwC or Cornerstone OnDemand should watch for official statements and review their exposure to third-party HR and learning platforms.