Global professional services network PwC has acknowledged a cybersecurity event linked to an external vendor responsible for managing staff learning documentation. This disclosure followed claims made a day prior by the cyber extortion collective Everest, which asserted it had downloaded 590 gigabytes of corporate files and issued a threat to publish them if its conditions were ignored.
According to PwC, the organization acted swiftly upon discovering the breach and locked down the compromised system. The firm additionally emphasized that neither its internal network nor its daily business functions suffered any disruption.
PwC Says Client and Financial Data Were Not Affected
A PwC international spokesperson stated that the compromised portal did not hold financial files, sensitive personal details, or client information. Following the discovery of the security breach, the enterprise initiated a comprehensive investigation.
Even so, PwC refrained from verifying the accuracy of Everest’s data theft assertions or detailing the exact volume of data that might have been compromised. The organization chose not to address the 590GB figure cited by the hackers.
The breach centers on an outside platform used for employee training archives. Although PwC has moved to alleviate client concerns regarding the event’s reach, it withheld additional specifics concerning the vendor infrastructure and the ongoing inquiry.
Everest Claims to Have Stolen 590GB of Data
The Everest syndicate took credit for the reported intrusion via an online notice posted on October 22, as tracked by the cybercrime intelligence site eCrime.ch. The perpetrators stated that the stolen archive comprised learning materials, regional human resources files, software pieces, and integration instructions. They additionally asserted the files held personal records and employment histories, featuring physical addresses, telephone numbers, names, and email addresses.
At this stage, these assertions are unverified claims made by the attackers and lack independent confirmation. Reports indicated that Everest included a five-day countdown timer on its site signaling when the information might be leaked, noting that publication could happen if negotiations with the corporation fell through.
Also Read: Capcom Breach Exposes Data Linked to 11.77 Million CAPCOM ID Accounts
Investigation Continues as Extortion Threat Looms
This event underscores the cybersecurity risks companies encounter when utilizing third-party suppliers to handle staff data and internal assets. External systems can serve as vulnerable access points for bad actors targeting business-related files. Even when core corporate networks stay secure, a breach impacting employee documentation generates significant privacy and security worries.
At present, PwC has verified the security incident while withholding confirmation regarding the precise contents or volume of the allegedly compromised files. Moving forward, the investigation must determine the root cause, identify what data may have leaked, and evaluate if additional measures are required.
