Excerpt from Cybersecurity Dive, Published on October 26, 2026
The PwC data breach has drawn attention after the global professional services firm confirmed a cybersecurity incident involving a third-party vendor that stores employee learning records. The disclosure followed claims by the Everest ransomware group that it had stolen approximately 590 gigabytes of company data. PwC stated that its internal network and business operations remained unaffected.
What Happened in the PwC Data Breach?
The incident involved an external vendor platform used by PricewaterhouseCoopers (PwC) to maintain employee learning records. On October 22, 2026, the Everest ransomware group claimed responsibility for the attack and alleged that it had obtained 590 gigabytes of information.
The group claimed that the stolen files included regional human resources records, employee learning materials, integration documentation, software components, and internal training courses. However, PwC has not independently confirmed the volume or contents of the allegedly stolen information.
According to Cybersecurity Dive, a PwC Global spokesperson confirmed that the company took prompt action to secure the affected environment and conducted a thorough review after learning about the incident. PwC also stated that the affected vendor platform did not contain client data, sensitive personal information, or financial records. The company confirmed that the incident had not disrupted its corporate network or business operations.
Everest Ransomware Group and Previous Cyberattacks
The Everest ransomware group has been associated with cyberattacks targeting organisations and critical infrastructure providers worldwide. According to cybersecurity research from Halcyon, the group has operated since late 2020 and has also acted as an initial access broker, supplying stolen credentials to other cybercriminal groups.
The group has reportedly attempted to recruit insiders by offering financial incentives and profit-sharing arrangements. In 2025, Everest also claimed attacks involving multiple international airports through an incident targeting Collins Aerospace.
The full extent of the PwC incident remains unclear, as the company has not confirmed Everest’s claims regarding the alleged data theft.
For additional information, read the full report from Cybersecurity Dive.
