PwC Confirms Cybersecurity Incident Involving Employee Learning Records

PwC said on October 23, 2026, that it was responding to a cybersecurity incident involving a third-party vendor used to host employee learning records. The disclosure came one day after a cyber extortion group claimed it had stolen 590 gigabytes of company data, Reuters reported.

What PwC said

A PwC global spokesperson said the affected site does not house client data, sensitive personal data or financial information. The firm said it acted promptly after learning of the incident, secured the environment and began a review. PwC also said the event did not affect its network or operations.

The company declined to comment on the amount of data allegedly taken or on the accuracy of the extortion group’s claims.

Extortion claim

The group, known as Everest, posted a claim on its website on October 22, according to the cybercrime research platform eCrime.ch. The post included a five-day countdown and said data would be released if an agreement was not reached.

Everest alleged that the material included regional human-resources and learning exports, integration documentation, software components and PwC e-learning courses. It also claimed the data contained information about individuals and their organizational and employment history, including names, email addresses, telephone numbers and addresses. Those details were allegations by the extortion group and were not independently verified in the Reuters report.

Third-party exposure

The incident highlights the security risks organizations face when external providers store internal records. PwC’s statement distinguished the affected learning environment from client systems and core operations while its investigation continued.

Sources

Reuters: PwC confirms cybersecurity incident involving employee learning records