The Everest extortion group has added PwC to its leak site, claiming to hold almost 600GB of material from the firm’s HR and corporate learning systems. PwC has not confirmed any breach, but the listing references a supplier-hosted platform, and that is a risk every UK organisation should be checking today.
What happened
On 22 October 2026, the Everest ransomware and extortion group published an entry naming PwC on its Tor leak site. Several independent services that monitor criminal leak sites, including Hackmanac, CTIWatch and Ransomware.live, logged the listing the same day. Ransomware.live files the victim under the United Kingdom.
According to the listing and the Hackmanac alert, Everest claims to have taken 590.69GB of data made up of 108,426 files. The gang says the material came from internal human resources and learning systems. Everest says the haul includes staff and employment details, training records, audit methodology and confidential files, plus code and configuration for the firm’s single sign-on setup.
The listing reportedly attributes the data to PwC operations in the UK, Australia, Canada and China. One HR dataset is said to contain 213,084 records, although nobody outside the gang knows how many distinct people that represents, or whether the records are current.
The leak-site post carries a countdown timer and urges the firm to make contact before the files are released. Some reports put the deadline at 28 October, but that date has not been independently confirmed and screenshots of the timer carry no reliable capture time.
PwC has not confirmed a breach, and at the time of writing there was no global or UK statement or regulatory disclosure acknowledging an incident linked to Everest. No statement from Cornerstone OnDemand, whose platform the listing references, could be found either. What has been verified is that Everest made the allegation, not that data was stolen.
The technical picture
The most revealing detail in the material Everest has shared so far is a directory name shown in a screenshot of the listing: pwc-stg.csod.com. The csod.com domain belongs to Cornerstone OnDemand, a widely used cloud platform for corporate learning, talent and HR management. The “stg” element is the conventional shorthand for a staging environment, the copy of a system used for testing integrations and changes before they reach production.
According to the listing, the folders supposedly hold Cornerstone platform materials, regional HR exports, e-learning content and documentation for integration testing and maintenance. Everest lists 494 directories, figures nobody has validated.
Several things are notably absent. No initial access method has been described, no vulnerability or compromised credential has been named, no indicators of compromise have been published, and nothing suggests PwC systems were encrypted. A directory name tied to a supplier’s domain does not show that Cornerstone’s platform was breached, nor that PwC’s own network was entered. The files could have come from a tenant administrator account, an integration service account, an export sitting on a file share, or somewhere else entirely.
Everest has run both encrypting ransomware and pure data-theft extortion, and has posted victims before producing proof. Tracker sites index what criminals publish; they do not verify it.
Why it matters for UK organisations
If the claim turns out to be genuine, the impact would land on PwC staff first. Detailed HR and training records give criminals exactly what they need for convincing impersonation: names, job titles, reporting lines, internal course names and the language a firm uses with its own people. For a Big Four firm whose staff deal daily with client finance teams, that could fuel invoice fraud well beyond PwC.
The regulatory clock would also matter. Under UK GDPR, a controller has 72 hours from becoming aware of a reportable personal data breach to notify the ICO, and where a processor such as a SaaS provider is involved, contracts should define how quickly the supplier must tell the controller. A leak-site listing is often how an organisation first learns of a problem.
The bigger lesson, regardless of how this particular claim resolves, is about where HR data actually lives. Most UK organisations of any size now run payroll, learning, recruitment and performance management on third-party platforms, and each one tends to have a production tenant, a staging or sandbox tenant, and a web of integrations feeding them. Those non-production copies are frequently populated with real employee data to make testing realistic, and they rarely get the same scrutiny.
Expert view
In my experience, staging environments are among the softest targets in any SaaS estate. When we test, we regularly find sandbox tenants that were cloned from production months earlier, still contain live personal data, sit outside single sign-on enforcement, and have local administrator accounts that nobody has reviewed since the implementation project ended. Integration accounts with long-lived, never-rotated API keys are another recurring weakness.
The mention of single sign-on source code and configuration in Everest’s claim deserves particular attention. If any working client secrets, signing certificates or federation metadata were genuinely included, the risk shifts from embarrassment to potential follow-on access. That is why I would treat secrets that may be referenced in leaked configuration as burned and rotate them, even before authenticity is established. Rotation is cheap; waiting for confirmation is not.
Equally, restraint matters. Leak sites are criminal marketing, and inflated or recycled claims are common. Until PwC, a regulator or credible researchers examine the material, the honest position is that we do not know what, if anything, was taken.
What to do now
For organisations that work with PwC, the sensible step is to watch for direct communication from your PwC contacts and official channels, and to brief finance and accounts payable staff to verify any unexpected request that appears to come from the firm. For everyone else, use this as a prompt to review your own HR and learning platforms:
- Inventory every tenant. List production, staging, sandbox and test instances of your HR, learning and payroll platforms, and who owns each one.
- Stop using live data in non-production. Mask or synthesise personal data in staging, and purge stale clones (Cyber Essentials: secure configuration).
- Put every tenant behind SSO and MFA. Remove or tightly control local administrator logins and break-glass accounts (Cyber Essentials: user access control).
- Review integration and API accounts. Restrict export permissions, rotate long-lived keys and certificates, and store secrets in a vault, not scripts.
- Log and alert on bulk exports. Make sure large report downloads and data extracts from SaaS platforms reach your SOC or MSP.
- Check supplier contracts. Confirm breach notification timescales, sub-processor lists and your right to audit, so you can meet the ICO’s 72-hour window.
- Rehearse a leak-site scenario. Agree in advance who verifies a listing, who speaks to staff and when you notify the ICO.
Bottom line
Everest’s claim against PwC is, for now, exactly that: a claim, with no confirmation from the firm and no independent proof of theft. But the details in the listing describe a scenario that is entirely plausible for any large employer, where a supplier-hosted staging copy of HR data becomes the weak point. Whatever the outcome for PwC, UK organisations should assume their own non-production HR environments are a target and secure them accordingly.
Sources
- Cyber Security News: PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data
- GBHackers: PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
- CyPro: Everest PwC Claim Remains Unverified
- Technijian: PwC Data Breach Claim: Everest Says 590 GB Stolen
- Ransomware.live: Victim entry, PwC (Everest)
