PwC confirms cyber incident as Everest claims 590 GB data breach - Beinsure

The global professional services firm acknowledged the incident on October 23, 2026, a day after Everest posted its allegations on a data leak website. PwC said it had taken steps to secure the affected environment and was reviewing the incident, but declined to confirm whether the group had obtained the reported volume of information.

The Everest extortion group threatened to publish allegedly stolen HR information, employee contact details, software components and training materials unless an agreement was reached.

Everest's Claims

The Everest group claimed responsibility for the alleged breach in a message published on its website on October 22, according to cybercrime research platform eCrime.ch. The posting included a countdown timer showing five days remaining, accompanied by a warning that the information would be released publicly if an agreement could not be reached.

Everest claimed to possess 590 GB of information comprising "regional HR and learning exports, integration documentation, software components and PwC e-learning courses." According to the group, the material also contained information about individuals and their organisational and employment history.

The allegedly compromised records included names, email addresses, telephone numbers, physical addresses and other personal details. These descriptions have not been independently verified. PwC declined to comment on the amount of information allegedly stolen or whether Everest's statements accurately represented the contents of the affected system.

PwC's Response

PwC said its internal network and operations were unaffected and that the vendor platform did not contain client data, sensitive personal information or financial records. The company also stated that the incident "does not impact our network or any of our operations," the spokesperson said.

The company's confirmation establishes that a security incident occurred at an external provider, but does not independently substantiate the alleged theft of 590 GB or the specific categories of information described by Everest.

Following discovery of the incident, the company said it acted promptly to secure the affected environment and undertake a review. The available statements do not establish how the external system was compromised, how many individuals may have been affected or whether attackers successfully removed the information they claim to possess.

Background on Everest

Everest is an established cyber extortion and ransomware group that has previously been associated with attacks against organisations operating in critical infrastructure and other industries. According to cybersecurity research published by Halcyon, the group emerged in late 2020 and has operated as an initial access broker, providing compromised credentials to other cybercriminal organisations.

Researchers have also documented attempts by Everest to recruit insiders, offering cash payments and profit-sharing arrangements in exchange for assistance. The group has claimed responsibility for attacks involving critical infrastructure providers across multiple countries.

In 2025, Everest claimed involvement in attacks affecting several international airports through an incident targeting aerospace technology provider Collins Aerospace. Those activities form part of the group's documented history, although its allegations concerning PwC remain unverified.

Third-Party Risk

The incident nevertheless raises questions about the security of corporate information stored by external technology providers, particularly systems that support employee training and human resources administration. PwC has not publicly identified the vendor involved or confirmed whether the alleged data exposure extends beyond employee learning records.

Such platforms can operate outside an organisation's primary IT infrastructure while maintaining information associated with employees and internal business processes. In this case, PwC has distinguished the external vendor incident from any compromise of its own network, and there is no confirmed evidence in the company's statements that its central systems were breached.

For PwC, the principal unresolved questions concern the extent of any unauthorised data access, the authenticity of Everest's claimed files and whether information associated with individuals was actually obtained. As of October 26, the company's confirmed position remained that an incident had occurred involving an external provider, its own network and operations were unaffected, and the allegations made by Everest had not been substantiated.