The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes human resources records, training materials, and internal documents. However, the claims are unverified, and PwC has not yet responded.
The group’s listing was reported on October 22, 2026. Hackmanac’s public alert described 108,426 files allegedly taken from internal HR and learning systems. Separately, CTIWatch’s victim tracker recorded PwC appearing on Everest’s leak site that day. These reports document the claim, not independent proof of a breach.
Alleged PwC Data Breach
The supplied leak-site screenshot names a directory, pwc-stg.csod.com, and describes Cornerstone OnDemand platform materials, regional HR exports, e-learning courses, and integration testing documents. It lists 494 directories, alongside 1,333 original archive containers and 53 nested containers. The screenshot alone does not establish how these materials were obtained.
Hackmanac reported that the alleged data spans PwC operations in Australia, China, Canada, and the UK. One HR dataset reportedly contains 213,084 records. That figure should not be read as a confirmed count of affected employees because the number of unique people remains unknown.
The alert also mentions employee information, employment and training records, internal audit methods, confidential documents, and single sign-on source code and configuration files. It does not establish whether working passwords, tokens, or other usable secrets are present.
PwC Data Breach Claim
The screenshot threatens publication after a countdown and urges the company to make contact. A reported October 28 release deadline has not been independently confirmed. No ransom amount, initial access method, or evidence of encrypted PwC systems has been established in the reviewed material.
Everest has previously used data theft claims to pressure named organizations, including its alleged McDonald’s India breach. However, its history includes both data extortion and file encryption, so this listing should not automatically be treated as proof of ransomware deployment.
A separate technical analysis of Everest ransomware found no data theft function inside one examined encryptor. Researchers noted that any theft could instead occur earlier through separate tools. That finding does not explain this alleged incident.
If authentic, detailed employee records could help criminals craft convincing phishing messages or impersonate staff. For now, the central questions remain data authenticity, ownership, access scope, and whether any records are current.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
——————————————————–
Click Here For The Original Source.
