PwC Confirms Vendor Breach as Everest Claims 590 GB of Staff Data

The Everest ransomware gang says it has stolen about 590 GB of HR and training data from PwC, a major professional services firm with US operations. PwC has not confirmed that figure. It has confirmed a cybersecurity incident at a third-party vendor that hosts employee learning records, and that confirmation is what separates this PwC data breach from a leak-site rumor.

Everest posted PwC on its extortion leak site on October 22. PwC responded on Friday, October 23, so the story is less than three days old, and the gang's stated deadline may fall within days. Here is what is confirmed, what is claimed and what remains open.

What Everest says it took from PwC

Everest listed PwC on its leak site and claimed to hold about 590 GB of the firm's data, according to Technijian's breakdown of the claim. That reporting puts the figure at 590.69 GB. Everest's posting reportedly included a five-day countdown before publication if no deal is reached, and a reported October 28 release date has not been independently confirmed.

The most granular version of the claim comes from a Hackmanac alert posted on X. It describes 108,426 files allegedly taken from PwC's internal HR and learning systems, and it says one HR dataset holds 213,084 records. The same alert lists SSO source code and configuration files, along with a regional spread that includes Australia, China, Canada and the UK. Those details rest on a single unverified claim, so they should be read as allegations.

According to Analytics Insight, the claimed contents include names, email addresses, phone numbers, physical addresses and employment history. That mix is useful to fraudsters. It is the kind of profile that makes convincing phishing easy to write.

What PwC has confirmed so far

PwC said it was aware of a cybersecurity incident involving a third-party vendor used to host employee learning records, according to a Reuters report republished by Global Banking & Finance. That statement came on October 23, after the extortion listing had already appeared. The acknowledgment followed the public claim rather than preceding it.

Reporting on PwC's position says the affected site held no client data, no sensitive personal data and no financial information. PwC also said its internal network and broader business operations were not affected, according to Shattered.io's coverage. Those are company assertions, and independent reporting has not verified them.

In the reporting reviewed, PwC has not confirmed the 590 GB figure, named the vendor, disclosed how many employees are affected or said whether any data was actually taken. It has also not said whether it will notify regulators or affected individuals, or in which countries.

Verified versus claimed in the PwC data breach

The table separates what has been confirmed from what remains an allegation.

The confirmed facts are narrow and the claimed facts are broad. That gap is common early in an extortion case, but readers should wait for PwC's own account before treating the 590 GB number as settled.

Why vendor platforms are the weak point for US employers

The vendor angle is what makes this story relevant beyond one firm. Veradigm, a healthcare technology company, disclosed in an SEC Form 8-K filed September 8, 2026 that an attacker used credentials stolen from a vendor to pull patient data through a Veradigm API, including some Social Security numbers. The Gentlemen group had listed Veradigm on its leak site on September 5, according to NetSec.News.

The Veradigm case is separate, and nothing in the PwC reporting links the two. The weakness is the same, though. A trusted third party holds valuable records, and one stolen credential can open a path around the employer's own defenses. Extortion crews gain a single door into many employers' records. Employees, who never picked the vendor and may not know it exists, carry most of the risk.

Everest's track record adds nuance. The group has been active since at least 2020, according to the Reuters report, and it has used both pure data theft for extortion and file encryption. A leak-site listing alone does not prove ransomware was deployed. One technical analysis of an Everest encryptor found no built-in data-theft function, which suggests any theft would have run through separate tools, according to Technijian. That finding does not settle the PwC case either.

USA 24 has also reported on Conduent's agreement to pay $80 million to settle a breach affecting 62 million people. Stolen access is a recurring thread in these cases, as USA 24's coverage of stolen Microsoft 365 tokens showed when 79 organizations were breached without passwords.

What PwC employees and HR teams should do now

Login abuse is often the entry point. USA 24 reported that the Florida DMV breach was traced to a police login, which shows how one credential can reach far more data than intended. The steps below reduce risk without waiting for the facts to settle.

For current and former PwC employees:

• Treat unexpected messages that mention PwC training, learning records or HR updates as suspect. Open the training portal or HR site by typing the address yourself rather than clicking a link.
• Expect impersonation that uses your name, email, phone number or job history. Verify any request for a password, one-time code or payment by calling a number you already have.
• Turn on multifactor authentication for work and personal email, and review recent sign-ins for unfamiliar locations or devices.
• Ask HR which vendor holds your learning and HR records, and whether that vendor has reported being affected.

For employers that outsource HR or training:

• Inventory every third-party HR, training and learning platform that holds employee data.
• Confirm what API credentials, service accounts and single sign-on access each vendor holds, and remove anything unused.
• Write contract terms that require vendors to disclose security incidents quickly and to share logs when a breach is suspected.
• Ask whether vendors can flag bulk exports from employee records, and set alerts for them.

What to watch next in the PwC case

Three developments will clarify the story. First, whether Everest publishes the data after its countdown, and whether the 590 GB figure holds up under examination. Second, whether PwC names the vendor, gives a count of affected employees and explains what regulators and individuals will be told. Third, whether another vendor serving large employers reports a similar intrusion in the coming weeks.

PwC has said client data and internal systems were not affected, and those statements can be tested as more information emerges. If records surface that include sensitive identifiers, the picture will change quickly. Until then, the most accurate position is to treat the claim as serious, the confirmation as partial and the details as unverified.