PwC Data Breach Claim - Everest Ransomware Group Claims to Have Stolen 590 GB of Data - CyberSecurityNews
The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, including human resources records and internal documents, though the company has not yet responded.
The alleged breach involves files from PwC’s internal HR and learning systems, including materials from the Cornerstone OnDemand platform and regional HR exports. The listing was reported on October 22, 2026, by Hackmanac and CTIWatch.
A screenshot posted on the group’s leak site shows a directory named pwc-stg.csod.com, containing 494 directories, 1,333 archive containers, and 53 nested containers. The material reportedly spans PwC operations in Australia, China, Canada, and the UK.
One HR dataset listed in the alleged breach contains 213,084 records, though this figure does not confirm the number of unique affected employees. The material also mentions employee information, training records, internal audit methods, and single sign-on configuration files.
Everest has previously used data theft claims to pressure organizations, including an alleged breach of McDonald’s India. The group’s history includes both data extortion and file encryption, so this listing should not automatically be treated as proof of ransomware deployment.
A separate technical analysis of Everest ransomware found no data theft function inside one examined encryptor, suggesting that any theft could have occurred earlier through separate tools. The group’s leak site threatens publication after a countdown and urges the company to make contact.
A reported October 28 release deadline has not been independently confirmed. No ransom amount, initial access method, or evidence of encrypted PwC systems has been established in the reviewed material. The central questions remain data authenticity, ownership, access scope, and whether any records are current.
Related
