Everest Ransomware Claims 590 GB Data Breach at PwC

Key Takeaways

• The Everest ransomware group alleges a 590.69 GB data breach from global professional services firm PwC.
• Stolen data reportedly includes human resources records, training materials, and internal documents across multiple regions.
• The claims remain unverified by PwC, and independent proof of a breach is still pending.
• The incident highlights the ongoing threat of data extortion by ransomware groups, even without confirmed encryption.

Everest Ransomware Claims Massive Data Breach Against PwC

The Everest ransomware collective has asserted responsibility for a substantial data breach targeting PwC, one of the world’s largest professional services networks. The group claims to have exfiltrated 590.69 GB of sensitive information, encompassing human resources documentation, internal training modules, and various confidential internal files. As of now, PwC has not issued a public statement addressing these allegations, leaving the claims unverified.

The ransomware group’s listing, which surfaced on October 22, 2026, was first highlighted by Hackmanac’s public alert system. This alert detailed the alleged theft of 108,426 files, purportedly sourced from PwC’s internal HR and learning platforms. Concurrently, CTIWatch’s victim tracker also documented PwC’s appearance on Everest’s dedicated leak site on the same day. These reports serve to document the claims made by Everest but do not constitute independent confirmation of a successful breach or data exfiltration.

Details of the Alleged Data Compromise

A screenshot from the leak site, provided by Everest, references a directory named pwc-stg.csod.com. This suggests the compromise of materials related to the Cornerstone OnDemand platform, which typically manages learning and talent development. The alleged data further includes regional HR exports, e-learning course content, and documents pertaining to integration testing. The screenshot lists 494 directories, along with 1,333 original archive containers and 53 nested containers. However, this visual evidence does not provide insight into the specific methods used to acquire these materials.

Hackmanac’s analysis indicates that the purported data spans PwC operations across Australia, China, Canada, and the United Kingdom. One specific HR dataset is reported to contain 213,084 records. It is crucial to note that this figure represents the number of records, not necessarily the unique count of individuals affected, as a single person may have multiple entries.

Further details from the alert mention a range of compromised information, including employee personal details, comprehensive employment and training records, internal audit methodologies, confidential corporate documents, and even source code and configuration files related to single sign-on (SSO) systems. The alert does not, however, confirm the presence of active passwords, security tokens, or other exploitable secrets within the stolen data.

Everest’s Tactics and Unconfirmed Ransom Demands

The leak site screenshot includes a countdown timer, threatening the public release of the stolen data if PwC does not establish contact. A reported deadline of October 28 for data release has not been independently substantiated. Critically, the reviewed materials offer no information regarding a specific ransom amount, the initial access vector used to infiltrate PwC’s systems, or any evidence suggesting that PwC’s systems were encrypted—a common hallmark of ransomware attacks.

The Everest group has a history of leveraging data theft claims for extortion purposes, as seen in their alleged breach involving McDonald’s India. While Everest has engaged in both data extortion and traditional file encryption in the past, the current listing should not be automatically interpreted as proof of ransomware deployment on PwC’s network. A previous technical analysis of an Everest encryptor did not reveal an integrated data theft function, suggesting that any data exfiltration might occur through separate tools prior to encryption attempts. This finding, however, does not definitively explain the circumstances of the alleged PwC incident.

What You Should Do

• Organizations should reinforce their data exfiltration detection capabilities, as data theft can occur independently of system encryption.
• Implement robust employee awareness training on phishing and social engineering tactics, especially given the potential for detailed employee records to be used for targeted attacks.
• Review and strengthen access controls and multi-factor authentication (MFA) across all critical systems, particularly those handling HR and learning data.
• Conduct regular security audits and penetration testing on external-facing applications and internal HR/learning platforms to identify and remediate vulnerabilities proactively.
• Develop and practice incident response plans specifically for data breach scenarios, focusing on rapid detection, containment, and notification protocols.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.