Everest Ransomware Group Claims Massive Data Theft from PwC
The Everest ransomware group has claimed to have stolen 590 GB of data from the global professional services firm PwC, including sensitive HR records and internal documents.
The Everest ransomware group has asserted a significant data breach against PwC, one of the world's largest professional services networks. The threat actor claims to have exfiltrated a staggering 590.69 GB of data, which reportedly includes extensive human resources records, training materials, and internal company documents. This claim was made public on October 22, 2026, and listed on Everest's dark web leak site.
Details emerging from the alleged leak suggest the stolen data originates from internal HR and learning systems. Reports indicate that the data spans PwC operations across multiple countries, including Australia, China, Canada, and the UK. One specific HR dataset is said to contain over 213,000 records, though the exact number of unique individuals affected remains unknown. The purported data also includes employee information, employment and training records, internal audit methodologies, confidential documents, and even source code and configuration files for single sign-on systems.
While the Everest group has provided a screenshot of their leak site, naming a specific directory related to the Cornerstone OnDemand platform and detailing various file types, these claims are currently unverified. PwC, the target of the alleged breach, has not yet issued a public statement or commented on the incident. The screenshot itself does not provide independent proof of how the data was obtained or confirm its authenticity.
The threat actor's leak site reportedly includes a countdown timer, threatening to publish the data if PwC does not engage. A deadline of October 28 has been mentioned in some reports, but this has not been independently confirmed. Crucially, there has been no mention of a ransom demand amount, the initial access method used by the attackers, or any evidence of PwC systems being encrypted.
Everest ransomware group has a history of employing data extortion tactics, aiming to pressure organizations by threatening to release stolen information. In the past, they have claimed responsibility for incidents such as an alleged breach of McDonald's India operations. However, their modus operandi has also included file encryption, meaning this claim should not be automatically interpreted as a ransomware deployment.
Technical analysis of the Everest ransomware itself has, in some instances, not revealed a data theft function within the encryptor. This suggests that any data exfiltration could have been carried out using separate tools deployed earlier in the attack chain. The specific methods used in this alleged PwC incident remain unclear.
If the claims are substantiated and the data is indeed authentic and comprehensive, it could pose significant risks. Detailed employee records could be leveraged by cybercriminals to craft highly convincing phishing campaigns, impersonate PwC employees, or conduct further targeted attacks. The potential for misuse of sensitive HR and internal data is substantial.
For now, the cybersecurity community awaits confirmation or denial from PwC. Key questions revolve around the authenticity of the data, its ownership, the scope of access achieved by the attackers, and whether any of the compromised records are current or contain exploitable credentials. The incident highlights the persistent threat of data exfiltration by ransomware groups, even when encryption is not the primary goal.