KPMG: what a Big Four firm's own cyber record actually shows
KPMG sells cyber-security advice to the world's largest organisations. So what does its own documented record look like — and what should a security leader take from it? The honest answer is that KPMG's publicly confirmed direct-breach history is limited. That is not the same as "secure." The real signal is in posture, supply-chain exposure and the structural risks that face every firm holding client crown-jewels.
The best-resourced firms that sell cyber services face the same structural security problems they advise clients on — third-party and supply-chain risk, cloud misconfiguration, insider access and sheer scale. KPMG's clearest acknowledged incident, KPMG Mexico in 2018–2019, was a cloud-storage bucket left on default settings with no password. Its Big Four peers were swept up in the 2023 MOVEit supply-chain wave. A 2026 ransomware listing against KPMG Netherlands is claimed by the attackers and denied by the firm. Expertise does not exempt an organisation from the mechanics of cyber risk — it raises the stakes.
The uncomfortable question
If your board hired KPMG to assess your security, would you assume KPMG's own house was in perfect order? It is a fair question to ask of any advisor — and an uncomfortable one, because the firms that know the threat landscape best are also among its most valuable targets. A Big Four firm holds the audit files, board papers and financial crown-jewels of thousands of clients at once. Breach one, and you breach a little of all of them.
This page is not a hit piece. KPMG's confirmed direct-breach history is genuinely thin, and we say so plainly rather than padding it. The value is in reading the pattern across what is on record — and in what it tells you about the risks your own organisation carries, whether or not it sells security.
Incident timeline
Every entry is tagged by verification level and tied to a dated source in the list below. Confirmed = firm-acknowledged or regulator-involved; Reported = credible press, not denied; Unverified claim = threat-actor assertion, often denied.
What happened — A small group of KPMG Mexico developers downloaded digital tax receipts from Mexico's tax authority (SAT) and stored them in an unauthorised Microsoft Azure Blob environment. Per KPMG's own internal report, the store was left on default settings and reachable over the internet without a password — a textbook cloud misconfiguration. KPMG's security office learned of it on 30 January 2019, after a blogger contacted a client; at least one unknown party had already accessed the data, and the group deleted the environment without authorisation.
Impact — Payroll and tax data — tax registry (RFC) codes, CURP numbers, social-security numbers, bank-account numbers and salaries — for employees of at least 41 KPMG clients (reporting named ArcelorMittal, Thyssenkrupp, Operadora de Hospitales Ángeles, ITESO and Profuturo GNP). Mexican regulators were reported to be weighing a fine of roughly 30 million pesos (~US$1.6M). Staff were dismissed or suspended; affected employees were offered Experian monitoring.
Source: KPMG internal report (22 Feb 2019), reported by Going Concern / El Economista, Apr 2019.
Reported
The MOVEit / Cl0p wave — KPMG's peers, not KPMG
What happened — Cl0p's mass exploitation of a zero-day in Progress MOVEit Transfer (CVE-2023-34362) hit 600+ organisations and tens of millions of people. Among professional-services firms, Cl0p publicly named and listed Big Four peers: PwC (the group claimed ~121 GB), EY (later adding 62 of its clients to the leak site), and Deloitte (which denied any client-data impact). KPMG was not among the organisations Cl0p named in this campaign in the public reporting reviewed here. This entry is included as honest sector context — the wave that swept KPMG's direct competitors — not as a KPMG incident.
Impact — No public evidence that KPMG itself was a direct MOVEit victim. The relevance is structural: the same third-party file-transfer dependency that exposed its peers is one every large firm carries. Absence of a public listing is not proof of immunity — it is the limit of what the record shows.
KPMG Australia — insider misuse of client data (not an external breach)
What happened — A whistleblower alleged KPMG Australia partners improperly accessed and shared confidential client information — board documents and audit data tied to Lendlease and Optus — internally to help teams bidding for work with rivals. This is an insider data-handling and governance failure, not a hack or ransomware event; it is listed separately so it is not conflated with an external cyber breach. Chairman Martin Sheppard apologised to the whistleblower and affected clients and conceded the firm's initial reviews lacked rigour.
Impact — CEO Andrew Yates resigned with immediate effect (reported 29 May 2026); the head of audit and assurance also resigned, and an interim CEO was appointed. KPMG fined a number of staff after an internal probe; ASIC opened an investigation into registered auditors involved and a parliamentary committee moved to take testimony. It belongs on a posture page because insider access to client crown-jewels is a named structural risk for consulting firms — the control that failed here was governance, not a firewall.
Nova ransomware — claimed breach of KPMG Netherlands (denied)
What happened — On 23 January 2026 the Nova ransomware group listed KPMG's Dutch operations on its dark-web leak site, claiming ~500 GB of data and posting sample files it tied to KPMG Indonesia, Indonesia's Ministry of Finance and a US Department of the Treasury office, with a 2 February deadline. KPMG disputed it: a spokesperson stated "the IT infrastructure and security systems managed by KPMG have not been compromised." No independent, forensic or law-enforcement confirmation has been reported.
Impact — Treat this strictly as a threat-actor claim, not a fact. It matters as posture signal, not as a confirmed loss: a sample-file-plus-countdown extortion listing is cheap to fabricate and trivial to over-state, and the named firm denies it. The honest read is "claimed, denied, unconfirmed."
Source: Teiss / Cyber Security News / Techzine, Jan 2026 (claim; KPMG denial on record).
The pattern across the record
The confirmed loss was mundane, not exotic. KPMG Mexico in 2019 was not a nation-state zero-day — it was a cloud bucket on default settings with no password, stood up outside normal governance by a handful of staff. The most reliable way sensitive data leaks is still the boring way.
The largest exposure risk is other people's software. The one event that hit multiple Big Four firms at once — MOVEit, 2023 — came through a vendor. KPMG was not publicly named, but the dependency class that exposed PwC, EY and Deloitte is universal.
Insider and governance failures are a breach channel too. The 2026 KPMG Australia matter was not a hack; it was people who were allowed to see client data using it wrongly. For a firm whose business is access to client crown-jewels, the inside is a first-class threat surface.
Extortion claims are cheap; confirmation is not. The Nova listing against KPMG Netherlands shows how a denied, unverified claim still becomes "news." A mature posture is one where the firm can answer fast because it already knows its own exposure — and where the rest of us resist treating a leak-site countdown as a confirmed fact.
What a security leader should take from this
Four moves that fall straight out of the record — each with a free PlayCISO tool to act on it.
Treat your third parties as part of your attack surface
The one event in this record that touched every Big Four firm at once came through a vendor's file-transfer product, not their own code. KPMG's peers were exposed because a supplier was. Inventory the vendors that hold your data, rank them by blast radius, and rehearse the one getting popped.
KPMG Mexico 2019 was not a sophisticated attack — it was a storage bucket on default settings, reachable with no password, holding other people's tax and payroll data. The costliest exposures are usually the dullest. Keep a register of where sensitive data actually lives and who can reach it.
Have the ransomware answer written before the listing appears
When Nova listed KPMG Netherlands with a countdown, the firm could answer within days because it already knew its own exposure. Your position on "claimed, denied, unconfirmed" should be decided in advance — not drafted under a deadline set by an extortion crew.
Insider access to client crown-jewels is a control, not a vibe
The KPMG Australia matter was a governance failure, not a hack: people who were allowed to see client data used it in ways they should not have. Least-privilege, access logging and a reporting channel that is taken seriously are the controls that catch this — model them deliberately.
As of October 15, 2026. This page is analysis and commentary built from public reporting; stated facts are tied to the sources above, and claims that are disputed or unconfirmed are labelled as such. If KPMG or another party has newer or corrective information, the record here should be updated to match it.
Frequently asked questions
Has KPMG been hacked or suffered a major data breach?+
KPMG's publicly confirmed direct-breach history is limited. The clearest acknowledged incident is KPMG Mexico in 2018–2019, where developers left tax and payroll data for employees of at least 41 clients in an Azure cloud store on default settings, reachable with no password. In January 2026 the Nova ransomware group claimed to have stolen ~500 GB from KPMG Netherlands, but KPMG denied any compromise and the claim is unconfirmed. KPMG was not among the firms Cl0p publicly named in the 2023 MOVEit supply-chain wave, although its Big Four peers PwC, EY and Deloitte were. A separate 2026 KPMG Australia matter involved insiders misusing client data, which is a governance failure rather than an external cyber breach.
Was KPMG affected by the 2023 MOVEit / Cl0p attacks?+
In the public reporting reviewed here, Cl0p did not name KPMG among its MOVEit victims. It did publicly list KPMG's Big Four peers — PwC, EY (adding 62 of EY's clients to its leak site) and Deloitte (which denied client-data impact). Absence from the leak site is not proof KPMG was untouched, but there is no public evidence it was a direct victim. The reason the wave still belongs on a KPMG posture page is structural: the same third-party file-transfer dependency that exposed its peers is one every large firm carries.
Is the Nova ransomware claim against KPMG real?+
It is unverified. On 23 January 2026 the Nova group listed KPMG Netherlands on its leak site, claimed roughly 500 GB of data and posted sample files, with a ransom deadline. KPMG disputed it, stating that the IT infrastructure and security systems it manages had not been compromised, and no independent or law-enforcement confirmation has been reported. Treat it as a threat-actor claim that the firm denies — not as an established breach.
Does a firm that sells cyber services get breached too?+
Yes — and that is the point of this page, not a gotcha. Big Four firms like KPMG are high-value targets precisely because they hold their clients' crown-jewels: audit files, board documents and sensitive financial data. The structural problems they advise clients on — third-party and supply-chain risk, cloud misconfiguration, insider access, scale, M&A-inherited risk — are the same ones they face. Selling cyber expertise does not exempt an organisation from the mechanics of cyber risk; it raises the stakes if they fail.
How confident should I be in these incidents?+
Each item is tagged. KPMG Mexico (2019) and the KPMG Australia insider matter (2026) are Confirmed — firm-acknowledged or regulator-involved. The MOVEit wave is Reported for KPMG's peers and explicitly noted as not naming KPMG. The Nova ransomware listing is an Unverified claim that KPMG denies. Every entry links to a dated source so you can check it yourself, and where the record is thin the page says so rather than filling the gap.
Run the same checks on your own organisation
The risks in this record — supply-chain exposure, cloud misconfiguration, insider access, ransomware readiness — are the ones every security leader owns. PlayCISO's free tools let you map and pressure-test them in your browser, no signup.