# PwC Confirms a Third-Party Cyber Incident After Everest Claims a 590 GB Breach

> PwC has confirmed a cybersecurity incident at a third-party vendor that hosts its employee learning records, after the Everest extortion group listed PwC and claimed ~590.69 GB of data. What PwC actually confirmed, what Everest claims (still unverified), and the third-party / LMS lessons for security leaders.

Source: https://playciso.com/blog/pwc-everest-ransomware-breach-claim · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.reuters.com/legal/litigation/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-2026-10-23/

---

On 22 October 2026 the **Everest** extortion group listed **PwC** on its dark-web leak site, claiming to hold roughly **590.69 GB** of the firm’s data. A day later PwC **confirmed a cybersecurity incident** — but a narrow one, and not on the terms Everest is selling. This is an independent, attributed read of what is actually established versus what is still just a threat actor’s claim. _PlayCISO is not affiliated with PwC, Everest or Cornerstone OnDemand; we originate none of the figures here._ ## What PwC actually confirmed As reported by **Reuters** (AJ Vicens, 23 October 2026), PwC said it was aware of a cybersecurity incident involving a **third-party vendor used to host company employee learning records**. A PwC global spokesperson said the **affected site "does not house client data, sensitive personal data or financial information"** and that, "once we learned of this incident we acted promptly to secure the environment and conduct a thorough review." The incident, the spokesperson added, **"does not impact our network or any of our operations."** PwC **declined to comment on the amount of data stolen or the veracity of the hacking group’s claims.** So the confirmed facts are tightly scoped: an incident at a _third-party_ platform holding _employee learning_ data, not PwC’s core network, and — per PwC — no client, audit-client, financial or sensitive personal data on the affected site. ## What Everest claims — and why it is still unverified Everest’s listing (dated 22 October, surfaced via leak-tracking services and security reporting) claims about **590.69 GB across 108,426 files**, described as "regional HR and learning exports, integration documentation, software components and PwC e-learning courses." The write-up references a directory, **pwc-stg.csod.com**, and names several regional operations (reports list Australia, Canada, China, the UK and others). The post carries a roughly one-week countdown — the familiar name-and-shame extortion pattern — threatening release if a deal is not reached. None of that is verified. **No sample files had been published** at the time of writing, PwC has not confirmed the volume, and the richer claims circulating on some threat-intel feeds (internal audit methodologies, SSO source code) are exactly the kind of high-impact framing a gang adds to pressure a target — unproven, and in tension with PwC’s own statement. Treat the 590 GB figure and the content list as the attacker’s marketing until evidence appears. Confirmed vs claimed — in one line each **Confirmed (PwC, via Reuters):** a cyber incident at a third-party vendor hosting employee learning records; no client / sensitive-personal / financial data on the affected site; no impact to PwC’s network or operations; environment secured and under review. **Claimed (Everest, unverified):** ~590.69 GB / 108,426 files of HR, learning and integration data from a pwc-stg.csod.com tenant, with a release countdown. No samples published; amount and contents not confirmed. ## The staging-tenant and LMS angle The `pwc-stg.csod.com` name is consistent with a **staging tenant on the Cornerstone OnDemand learning platform** — though, again, PwC has not named the vendor. Two things make this worth a security leader’s attention regardless of the final numbers. First, **staging and test environments** are a chronic weak spot: they are often spun up with copies of real HR and training data but with thinner access control, logging and monitoring than production, because "it’s only test." Second, **learning and HR SaaS platforms** are easy to wave through procurement as low-risk, yet they hold employee PII — names, contact details, employment and training history — which is precisely what an extortion group monetises. ## What to check this week - Inventory your learning / HR / talent SaaS and record what employee personal data each tenant actually holds, including any staging or sandbox tenants. - Treat non-production tenants as production when they contain real data: same authentication (phishing-resistant MFA / SSO), same logging, same egress and access review — or mask / synthesise the data so they don’t hold the real thing. - Put the obligations in the contract: a breach-notification SLA, a current subprocessor list, and the right to evidence (SOC 2 / ISO 27001, pen-test summaries). Score the vendor before and during the relationship. - Rehearse a third-party incident: who you call, how you confirm scope, and how you communicate when the breached system belongs to a vendor, not you. - Prepare the employee-PII response: even a "learning records only" breach can trigger notification duties and erode trust — have the comms and regulatory clocks mapped in advance. Run a structured vendor review with the free [Vendor Risk Scorecard →](/tools/vendor-risk-scorecard), see the questions to ask in our [vendor security assessment checklist](/blog/vendor-security-assessment-checklist) and the fourth-party angle in [what are subprocessors](/blog/what-are-subprocessors), and put a defensible dollar figure on employee-data exposure with the [Breach Cost calculator](/tools/breach-cost) (see also [what a data breach actually costs](/blog/data-breach-cost-explained)). ## Frequently asked questions **Did PwC confirm a breach?** It confirmed an incident at a third-party vendor hosting employee learning records; it did not confirm Everest’s 590 GB claim. Per PwC, the affected site held no client, sensitive-personal or financial data, and its network and operations were unaffected. **What did Everest claim?** ~590.69 GB / 108,426 files of HR, learning and integration data from a pwc-stg.csod.com tenant, with a release countdown — unverified, no samples published. **What is pwc-stg.csod.com?** A name consistent with a staging tenant on the Cornerstone OnDemand LMS; PwC has not publicly named the vendor. **Was client or audit data exposed?** PwC says no client / sensitive-personal / financial data was on the affected site; the audit-methodology and SSO-source-code claims are unverified and conflict with that statement. **The lesson?** Learning and HR SaaS — and their staging tenants — are in-scope vendor risk holding employee PII; inventory, harden, contract and rehearse for them.