PwC: what a firm that sells cyber advice shows about its own risk
A trend analysis of PwC's documented data-security record from 2014 to 2026. The thesis is not that PwC is uniquely insecure — it is that even a best-resourced firm that sells cyber services faces the same structural problems every organisation does: third-party and supply-chain exposure, insider risk, and data governance at scale. Each incident below is tagged Confirmed, Reported or Unverified claim, with a dated source.
PwC's publicly confirmed direct-breach history is relatively limited. Its most significant data-security event — the 2023 MOVEit / Cl0p wave — reached PwC through a third-party file-transfer tool, not its own network. The 2014 LuxLeaks episode was an insider disclosure. A 2019 Greek GDPR fine was a data-governance finding, not a hack. A 2024 leak-forum listing remains unverified. We do not pad this record, and we do not conflate non-cyber regulatory or ethics matters with cyber breaches.
The uncomfortable question
PwC advises many of the world's largest organisations on cyber risk, resilience and incident response. So the uncomfortable question for any security leader is simple: if a firm with that depth of expertise, budget and talent still ends up with client data on a dark-web leak site, what hope does an ordinary enterprise have?
The honest answer is reassuring in a backwards way. PwC did not get breached because it was careless with its own perimeter — on the record, its internal network held. It got hit the way almost everyone gets hit now: through a trusted third party's software, and, years earlier, through an insider with legitimate access. Those two vectors are the structural ones no amount of advisory expertise removes. That is the lesson, and it is worth more than a scorecard.
Incident & data-security timeline
Documented events only. Non-cyber matters — audit-independence fines, the Australian tax-leak ethics scandal — are deliberately excluded here and touched on only as posture context below, so a regulatory matter is never mistaken for a breach.
November 2014ConfirmedInsider data loss / confidentiality
LuxLeaks — insider exfiltration of ~28,000 pages of client tax rulings
What happened. A former PwC Luxembourg employee, Antoine Deltour, copied roughly 28,000 pages of confidential client tax rulings from the firm’s internal document systems; the files were later published by the International Consortium of Investigative Journalists. A second ex-employee, Raphaël Halet, supplied a further set of tax documents. In court a PwC expert said the material had been accessible owing to a server misconfiguration since fixed. This was a whistleblower disclosure, not an external intrusion — but the firm’s most sensitive client data left through an insider path PwC did not control.
Impact. Thousands of confidential client advance-tax-ruling documents made public; years of litigation; a European Court of Human Rights whistleblower-protection case (Halet v. Luxembourg). PwC acknowledged the documents originated from its systems.
July 2019ConfirmedData-protection enforcement (not a breach)
Hellenic DPA fines PwC Business Solutions €150,000 over employee-data handling
What happened. Greece’s Hellenic Data Protection Authority (decision 26/2019) fined PwC Business Solutions SA €150,000 — the first GDPR fine issued in Greece. It found the firm had relied on employee consent as the legal basis for processing staff personal data when a different basis was actually in use, making the processing unfair and non-transparent, and had improperly shifted the burden of proving compliance onto employees. This is a lawful-basis/accountability finding, not a hack or a data leak; it is included because it is a documented, regulator-confirmed data-governance failure, and deliberately kept distinct from the breach events above and below.
Impact. €150,000 penalty plus an order to bring employee-data processing into compliance within three months. PwC Greece publicly contested the characterisation while the decision stood.
MOVEit / Cl0p supply-chain wave — client data taken via a third-party file-transfer zero-day
What happened. PwC was one of many organisations caught in the mass exploitation of a zero-day in Progress Software’s MOVEit Transfer by the Cl0p ransomware group. PwC confirmed it used MOVEit "with a limited number of client engagements," said it stopped using the platform as soon as it learned of the incident and launched its own investigation, and stated its internal IT network was not compromised — only the MOVEit database. Affected clients were notified their files were "impacted." Cl0p subsequently listed PwC-related data on its leak sites (reported as 11 batches on the dark web and 4 on the clear web).
Impact. A limited but undisclosed number of client engagements affected; client files exfiltrated and published by Cl0p. PwC did not disclose record counts or data types. The vector was entirely third-party: a vendor’s software flaw, not PwC’s own perimeter.
Hacker-forum listing claims ~255GB of PwC data for sale
What happened. A threat actor posted on a hacker forum claiming to hold about 255GB of PwC data — reportedly ~18,900 internal files said to include client reviews, HR documents and employee file-share contents — offered in exchange for forum credits. The claim was surfaced in security-vendor reporting. PwC has not confirmed it, no independent verification of the sample has been published, and the provenance and authenticity of the alleged data are unestablished. Treat this strictly as an unverified claim, not as a confirmed breach.
Impact. None independently established. If genuine, it would point again to client- and employee-data exposure; as of this writing it remains an unverified leak-forum listing.
The dominant vector is third-party, not perimeter. The single largest confirmed exposure — MOVEit 2023 — came through a vendor's file-transfer product. Consulting firms sit at the centre of enormous third-party webs, both as a buyer of software and as a processor of clients' crown-jewel data. That concentration makes them a high-value target and multiplies the blast radius of any one supplier's flaw.
Insider and confidentiality risk recurs. LuxLeaks (2014) was an insider copying ~28,000 pages of client rulings; the broader Australian tax-leak scandal that engulfed PwC from 2023 — an ethics and confidentiality failure, not a cyber breach, which is why it is not in the timeline — is the same theme from a governance angle. People with legitimate access remain one of the hardest risks to control, regardless of how good the external defences are.
Data governance is a security problem too. The 2019 Greek GDPR fine was about lawful basis and accountability for employee data — no attacker involved. For a CISO, that is a reminder that "protecting data" includes how it is collected and justified, not only how it is defended.
Uncertainty is part of the picture. The 2024 forum listing shows how leak-site claims circulate faster than verification. A mature posture resists the urge to treat every claim as fact — or to dismiss it — until evidence lands.
CISO takeaways
Turn the pattern into practice. Each takeaway links to a free PlayCISO tool that operationalises it.
Treat third-party risk as continuous, not a one-off form
PwC’s most significant confirmed exposure came through a vendor’s MOVEit software, not its own network. Inventory every tool that touches sensitive data, know which hold file-transfer or client data, and re-assess them as new vulnerabilities land — not once at onboarding.
Keep a live register of your crown-jewel data and its custodians
LuxLeaks and the 2024 claim both centre on client and employee files. Maintain a risk register that names your most sensitive data assets, where they live, who can reach them, and the controls on each — so an insider path or a shadow vendor is a known risk, not a surprise.
Rehearse the extortion-and-leak playbook before Cl0p-style actors force it
The MOVEit wave ended with stolen client files posted on dark- and clear-web leak sites. Have a decision tree for mass third-party exfiltration: notification duties, leak-site monitoring, and a no-fabrication communications stance that preserves uncertainty the way this page does.
Watch the software supply chain, not just the vendor contract
The flaw was in a widely-used file-transfer product. Tracking the components and dependencies your suppliers ship — and the live advisories against them — turns a vendor’s zero-day into an alert you can act on rather than a breach you read about later.
PwC’s publicly documented direct-breach history is relatively limited. Its most significant confirmed data-security event was the 2023 MOVEit supply-chain wave, in which the Cl0p ransomware group exploited a zero-day in a third-party file-transfer tool PwC used with a limited number of client engagements; PwC said its own internal network was not compromised and that only the MOVEit database was breached. Earlier, the 2014 LuxLeaks episode saw a former employee copy about 28,000 pages of confidential client tax rulings — an insider disclosure, not an external intrusion. A separate 2024 hacker-forum listing claiming ~255GB of PwC data is unverified and was not confirmed by PwC.
What was PwC’s role in the MOVEit breach?+
PwC was a downstream victim, not the source of the flaw. The vulnerability was a zero-day in Progress Software’s MOVEit Transfer product, mass-exploited by the Cl0p ransomware group in mid-2023. PwC used the software for a limited number of client engagements, stopped using it once the incident came to light, and ran its own investigation. Client files were exfiltrated and Cl0p later listed PwC-related data on its leak sites. PwC stated its internal IT network was not compromised — the exposure came entirely through a vendor’s software.
Was the 2019 GDPR fine a data breach?+
No. The €150,000 penalty from Greece’s Hellenic Data Protection Authority (decision 26/2019) was a lawful-basis and accountability finding about how PwC Business Solutions processed employee personal data — it relied on consent where a different legal basis applied. It was not a hack or a data leak. We list it as a documented data-governance enforcement action, kept deliberately separate from the breach events, because conflating regulatory fines with cyber breaches would misrepresent the record.
Is the 2024 255GB PwC leak real?+
It is unconfirmed. A threat actor posted on a hacker forum claiming about 255GB (~18,900 files) of PwC data, including client reviews and HR documents. PwC did not confirm it and no independent verification of the sample has been published. It should be treated as an unverified leak-forum claim, not as an established breach.
What should a security leader learn from PwC’s record?+
Two structural lessons stand out. First, third-party exposure is unavoidable: PwC’s biggest confirmed data-security event came entirely through a vendor’s file-transfer software, not its own perimeter — which is why continuous third-party/vendor risk management matters more than a one-time assessment. Second, insider and data-governance risk is just as real as external attack: LuxLeaks was an insider walking out with client crown-jewels, and the 2019 GDPR action was a lawful-basis failure. A firm that sells cyber advice still faces the same structural problems every organisation does.
This page is independent analysis and commentary for security-leadership education. It is not affiliated with or endorsed by PwC. Stated facts are attributed to the dated sources above; where a matter is disputed or unconfirmed, it is labelled as such. PwC is a trademark of its respective owner. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout