Global professional services firm PwC has confirmed a cybersecurity incident involving a third-party vendor responsible for hosting employee learning records, raising fresh concerns about the risks companies face when external providers handle internal information.
The disclosure came on October 23, 2026, a day after a cyber-extortion group known as Everest claimed to have stolen 590 gigabytes of data linked to the company.
PwC said it acted promptly after learning about the incident, securing the affected environment and launching a thorough review.
The firm also clarified that the affected website did not contain client data, sensitive personal information or financial records.
According to the company, the incident has not affected its internal network or business operations.
However, PwC declined to confirm the amount of information allegedly stolen or whether the claims made by the cyber-extortion group were accurate.
Everest claimed that the alleged stolen material included human resources records, employee learning data, integration documentation, software components and online training courses.
The group also alleged that some of the information contained personal and employment details.
These claims have not been independently verified, and the full extent of the incident remains unclear.
PwC has not publicly identified the affected vendor or disclosed how the incident occurred.
The development highlights the cybersecurity challenges facing large organisations that rely on external technology providers to manage employee information and other internal services.
Although third-party platforms can help businesses streamline operations and reduce administrative costs, they can also introduce security risks if their systems are compromised.
An incident involving a supplier may expose an organisation to reputational and operational concerns even when its own network remains unaffected.
For professional services firms such as PwC, protecting information is particularly important because clients depend on them to handle confidential business matters.
While the company has said client information was not housed on the affected website, the investigation will be important in determining the actual scope of the incident.
The case also underscores the growing use of data theft and extortion by cybercriminal groups.
Rather than relying solely on encrypting computer systems, attackers may attempt to obtain information and threaten to publish it unless their demands are met.
For businesses, the incident reinforces the need to assess the security practices of third-party vendors, limit access to sensitive information and establish clear procedures for responding to cybersecurity incidents.
As investigations continue, further details about the affected platform and the information involved may help clarify the potential consequences for PwC and its employees.
source: Channel NewsAsia
