PwC said Friday it is aware of a cybersecurity incident at a third-party vendor that hosts the firm's employee learning records, Reuters reported, a day after a cyber extortion group claimed to have stolen company data. The case puts the accounting and consulting firm in a position many large companies now share: its own network appears intact, yet it must answer for data held by a supplier.
What Happened
A PwC global spokesperson told Reuters that "the affected site does not house client data, sensitive personal data or financial information," and said the firm acted promptly to secure the environment and conduct a thorough review. The spokesperson said the incident does not affect PwC's network or operations. Reuters did not name the vendor.
The extortion group Everest claimed responsibility in a post on its website on Oct. 22, according to the cybercrime research platform eCrime.ch, as cited by Reuters. The group says it holds 590 gigabytes, including regional human resources and learning data exports, integration documents, software components and PwC e-learning courses, and that the material includes people's names, email addresses, phone numbers, addresses and employment histories. These are claims by a criminal group and have not been verified. PwC declined to comment on how much data was taken or whether the claims are accurate.
Everest's post carried a countdown timer with five days remaining and threatened to release the data if no deal was reached, Reuters reported.
Why It Matters
Training and learning platforms are often treated as low-risk software, but they can hold staff rosters, contact details and reporting lines, information that can help criminals write convincing targeted phishing messages. PwC's description of the affected site and the group's description of the stolen files differ sharply. Until that gap is resolved, employees cannot know what, if anything, about them was exposed.
For boards, the episode is a reminder that third-party risk reviews should cover every vendor holding employee data, not only those handling clients or money. Contract terms that require prompt notice, cooperation with forensic reviews and a clear inventory of the data a supplier holds make it possible to answer the first question regulators and staff will ask: what was actually on the system.
What to Watch
Everest's countdown points to a possible leak in the coming days. Watch whether any data is published and whether it matches the group's description, whether PwC or the vendor identifies the platform involved, and whether the firm's review leads to notifications to employees or data-protection regulators.
