PwC confirms third-party breach of employee learning records as Everest claims 590 GB theft

On 22 October 2026, PwC — the London-headquartered global professional-services network and one of the Big Four accounting firms — confirmed a cybersecurity incident after the Everest cyber-extortion group claimed on its dark-web leak site to have stolen 590 GB of the firm's data. PwC said the incident involved a third-party platform used to host employee learning records, rather than its own internal systems, and stressed that it had moved quickly to secure the affected environment and launch a review.

In its statement, PwC said the compromised platform did not store client data, sensitive personal information, or financial records, and that its internal network and broader business operations were unaffected. The firm declined to confirm Everest's 590 GB figure or to say how much data may actually have been accessed, and it did not name the third-party vendor involved. As of the disclosure, the investigation remained ongoing.

What Everest claimed

Everest's leak post, which security trackers dated to 22 October 2026, said the stolen trove included regional human-resources and learning records, integration documentation, software components, and PwC e-learning courses, along with employee contact details such as names, email addresses, phone numbers, physical addresses, and employment history. The group attached a countdown indicating roughly five days remained before it would release the data, a common pressure tactic used to force negotiation. None of these claims had been independently verified at the time of disclosure, and it was not clear whether any file encryption was involved.

A recurring extortion pattern

Everest, which operates a name-and-shame leak site and has increasingly focused on data-theft extortion rather than file-encrypting ransomware, has claimed a string of high-profile victims across 2026. The PwC case fits a broader trend in which attackers target the smaller third-party platforms and vendors that large enterprises rely on — in this instance an employee-training system — to reach data belonging to a far bigger and better-defended organisation. With PwC's investigation unfinished and the scope of any exfiltration unconfirmed, the incident's status is ongoing.