On October 22, 2026, the Everest ransomware group listed PwC on its leak site, claiming to have stolen 590.69 GB of data. Cyber Security News reported the listing on October 23, noting that "PwC has not yet responded" and that the reports "document the claim, not independent proof of a breach." This post keeps those two things apart: what Everest says it holds, and what anyone has actually verified.
TL;DR
| Question | Answer |
|---|---|
| Was PwC breached? | Unconfirmed. Listed on Everest's leak site on Oct 22 |
| Who claims it? | Everest ransomware group |
| Claimed size | 590.69 GB; Hackmanac describes 108,426 files |
| Claimed contents | HR exports, training and e-learning material, integration tests, audit methods, SSO source and configuration |
| PwC response | None found at time of writing |
| Which PwC firm? | Not named. Hackmanac says Australia, China, Canada and the UK are involved |
| Ransom amount, access method | Not established |
Claimed vs verified
| Claim | Status | Source |
|---|---|---|
| PwC appears on Everest's leak site | Observed by trackers (CTIWatch recorded it Oct 22) | CTIWatch |
| 590.69 GB stolen | Claimed by Everest | Cyber Security News |
| 108,426 files from HR and learning systems | Reported by Hackmanac, no link published | Cyber Security News |
A pwc-stg.csod.com directory with 494 directories and 1,333 archive containers | Visible in a leak-site screenshot only | Cyber Security News |
| Employee records, internal audit methods, SSO source and configuration | Alleged by Hackmanac | Cyber Security News |
| An HR dataset with 213,084 records | Reported; not a count of unique people | Cyber Security News |
| Working passwords, tokens or other usable secrets included | Not established | Cyber Security News |
| Release deadline of Oct 28 | Reported, not independently confirmed | Cyber Security News |
| PwC confirmed a breach | No statement found |
Note the directory name. The csod.com suffix is Cornerstone OnDemand's domain, and the -stg label suggests a staging environment. If the screenshot is genuine, that points to a learning-management integration and its test data rather than PwC's client work. That is an inference from the name, not something PwC or the reporter has confirmed.
Why the details matter more than the headline
A 590 GB figure sounds like a client-data catastrophe. The described contents are narrower: HR exports, course material and integration testing documents. That is still sensitive, since HR exports carry personal data and training platforms are often wired into single sign-on. But the gap between the number and the contents is exactly why claims need verifying before anyone draws conclusions.
Two things stay open:
- The SSO files. Source code and configuration for single sign-on are only dangerous if they contain live secrets such as client secrets, signing keys or tokens. The reporting says it is not established whether they do.
- The ransomware label. Everest has used both encryption and pure data extortion. A listing is consistent with either, so treat "ransomware attack" as unproven.
What to check if you work with a large consultancy
This is a claim about one firm's HR and training systems, so most readers have nothing to do today. For teams that exchange data or access with any large professional-services firm, a short review is worth the time whether or not this claim holds:
- List the credentials you have shared. Service accounts, API keys and SSO client secrets that sat in a shared workspace, ticket or onboarding document.
- Rotate anything long-lived that you cannot account for, and prefer scoped, expiring tokens for contractors.
- Review SSO integrations with external parties: which apps trust their identity provider, and with what scopes.
- Watch for phishing that cites real project names. HR and training data makes believable lures for staff at PwC and at firms that work with them.
- Keep secrets off developer machines where agents can read them. Coding agents read
.envfiles and configuration; Beam flags and asks for approval when an agent touches credential files locally, which makes it easier to see where copies of secrets live.
What to watch for
- A statement from PwC or a member firm confirming, narrowing or denying the claim.
- Whether Everest publishes sample files, and whether researchers find live secrets in them.
- The reported October 28 deadline, and whether data is actually released.
- Whether other Everest listings share the same access path.
We will update this post as soon as PwC or a named research team confirms or refutes the claim.
Related reading
- October 2026 attacks timeline
- OpenRouter breach claim: what is verified and what is not
- Railway breach: environment variables accessed, rotate every secret
Sources: Cyber Security News: PwC data breach claim · CTIWatch victim record · Cyber Security News: Everest ransomware technical analysis
Details are accurate as of October 23, 2026. This is a developing claim and may change.