PlayCISO · Breach Index
The Consultancy Cyber Breach Index
Do the firms that sell cybersecurity to everyone else keep their own house in order? This index tracks the public cyber posture of the largest advisory and IT-services firms, one firm per page, as a trend over roughly the last decade.
Advisory firms are concentrated, high-value targets: they hold their clients’ most sensitive data, sit deep in supply chains, and grow by acquisition. The pattern that shows up across these pages is not incompetence — it is that the same structural problems they advise clients on (third-party risk, identity, cloud configuration, M&A-inherited debt, insiders) reach them too. The lesson is for every security leader, not a scoreboard.
The firms
- Deloitte
From the 2017 no-MFA email breach to the US$12M Rhode Island RIBridges incident — identity gaps and third-party exposure at the world’s largest professional-services firm.
- PwC
The LuxLeaks insider data loss, the 2023 MOVEit third-party wave, and an unverified 2024 forum listing — a limited direct-breach record that leans on supply-chain and insider risk.
- EY (Ernst & Young)
Swept up in the 2023 MOVEit wave, a 2025 Azure SQL-backup exposure, and a 2026 third-party tax-platform intrusion — a third-party-heavy signature.
- KPMG
A 2018–19 Mexican cloud-storage exposure, a 2026 Australian insider-governance scandal, and a denied ransomware claim — limited public disclosure, read in sector context.
- Accenture
The 2017 exposed AWS S3 buckets and the 2021 LockBit ransomware attack — cloud configuration and ransomware, both company-confirmed.
- McKinsey & Company
A thin public record read in sector context: the 2011 Epsilon vendor breach and a reported 2026 internal-AI-platform incident.
- Boston Consulting Group
No confirmed breach on the public record and one weakly-sourced 2026 claim — a posture-and-sector-risk read for a strategy firm.
- Bain & Company
A thin public record and a single unverified 2026 internal-AI-tool claim — why the absence of public breaches is not proof of safety.
- Booz Allen Hamilton
Insider and cloud-configuration exposures — Snowden, Harold Martin, and a 2017 unsecured S3 bucket — at a top US government cyber contractor.
- IBM (Consulting & Security)
The firm that benchmarks everyone’s breach cost, caught as a data processor in the 2023 MOVEit wave (Colorado and Missouri Medicaid data).
How to read these pages
Every incident is dated and tied to a source, and tagged by how well it is established:
- Confirmed — acknowledged by the firm, or established by a regulator or court.
- Reported — credible press reporting the firm has not denied.
- Unverified claim — a leak-site or threat-actor claim with no independent confirmation. Stated as a claim, never as fact.
PlayCISO is not affiliated with any firm listed here. Pages cover publicly reported events only and are updated as new, sourced information emerges. Regulatory matters unrelated to cybersecurity (audit or accounting fines, for example) are excluded or clearly marked as non-cyber.
Put the same lens on your own program.
Quantify what an incident would cost and whether your controls pay for themselves with the free Risk Register, the Ransomware Readiness tool, and the Breach Impact estimator.