Everest ransomware guruhi PwC — "Katta To'rtlik" professional xizmatlar firmalaridan biri bilan bog'liq taxminan 590 GB ma'lumotni o'g'irlaganini da'vo qilmoqda. Da'vo ichki inson resurslari va o'quv tizimlariga tegishli, ammo bu tasdiqlanmagan, chunki hech qanday mustaqil hisobot buni tasdiqlamagan.
Crypto India tomonidan ulashilgan postda aytilishicha, taxmin qilingan o'g'irlik 108 426 ta faylni o'z ichiga oladi, jumladan xodimlar yozuvlari, ishga qabul qilish va o'qitish ma'lumotlari, maxfiy audit hujjatlari va yagona kirish (single sign-on) manba kodi. Bu tavsiflar da'volarni aks ettiradi va tekshiruv natijasida tasdiqlangan topilmalar emas.
Oqish saytidagi skrinshot "pwc.com 590 GB Database" deb nomlangan ma'lumotlar to'plamini ko'rsatadi va umumiy hajmi 590,69 GB bo'lgan 108 426 ta fayl 494 ta katalogda joylashganini, shuningdek 19 324 ta faylni o'z ichiga olgan 1 386 ta arxiv konteyneri borligini da'vo qiladi. Bu raqamlar hujumchining inventarini ifodalaydi va mustaqil tasdiqlangan umumiy hajm sifatida talqin qilinmasligi kerak.
Ro'yxat "pwc-stg.csod.com" katalogiga ishora qiladi. U ichki korporativ o'quv ma'lumotlari, Cornerstone OnDemand platformasi bilan bog'liq materiallar, mintaqaviy HR almashinuvi, elektron o'quv kurslari va integratsiya sinovi hamda texnik xizmat ko'rsatish hujjatlarini tavsiflaydi. Bu ishora o'zi PwC infratuzilmasi, xizmat ko'rsatuvchi provayder yoki boshqa muhitga kirish bo'lganligini tasdiqlamaydi.
Hackmanac tomonidan qo'shimcha hisobotda taxmin qilingan ma'lumotlar bir nechta mintaqaviy operatsiyalarga, jumladan Avstraliya, Xitoy, Kanada va Buyuk Britaniyaga tegishli ekani aytiladi. Shuningdek, bitta HR ma'lumotlar to'plami 213 084 ta yozuvni o'z ichiga olishi qayd etiladi. Biroq bu raqam qancha noyob shaxs ta'sirlanganini aniq ko'rsatmaydi.
Skrinshotda taxminan besh kun qolgan sanash taymeri ko'rsatilgan. U taymer tugaganda fayllar e'lon qilinishini ogohlantiradi. Shuningdek, kompaniya hujumchilar bilan bog'lanish uchun vaqti borligi aytiladi, bu esa taxmin qilingan ma'lumotlar tovlamachilik (extortion) uchun vosita sifatida ishlatilayotganini anglatadi.
Biroq rasm qachon olinganini ko'rsatmaydi va ishonchli e'lon qilish muddatini taqdim etmaydi. Bundan tashqari, oqish saytida ro'yxatning mavjudligi ransomware hech qanday tizimni shifrlamaganini, biznes operatsiyalarini buzmaganini yoki da'vo qilingan fayllar haqiqiy ekanligini ko'rsatmaydi. 🚨 SO'NGGI XABAR: Everest xakerlik guruhi "Katta To'rtlik" audit firmalaridan biri PwC dan 590 GB ma'lumot o'g'irlaganini da'vo qilmoqda.
Taxmin qilingan o'g'irlangan ma'lumotlar ichki HR va o'quv tizimlaridan 108 426 ta faylni o'z ichiga oladi, jumladan xodimlar yozuvlari, ishga qabul qilish va o'qitish ma'lumotlari, maxfiy audit… pic.twitter.com/FCvnF27zjf
— Crypto India (@CryptooIndia) 2026-yil 22-oktabr
Hozirgi hisobotlar dastlabki kirish vektori, foydalanilgan zaifliklar, zararli dastur yuklamasi yoki tasdiqlangan buzilish ko'rsatkichlarini aniqlamaydi. Kuzatuv xizmatlari Everest ro'yxatini 2026-yil 22-oktabrda qayd etgan, ammo hujumchining e'lonini kuzatish buzilishni tasdiqlamaydi.
Asosiy javobsiz savollar ma'lumotlarning haqiqiyligi, ta'sirlangan yuridik shaxslar va har qanday ishlab chiqarish muhitiga kirish bo'lgan-bo'lmaganligi bilan bog'liq. Tasdiqlovchi dalillar paydo bo'lmaguncha, bu hodisa tasdiqlangan ransomware buzilishi emas, balki taxmin qilingan ma'lumot o'g'irligi va tovlamachilik da'vosi sifatida xabar qilinishi kerak.
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it.
A post shared by Crypto India states that the alleged theft includes 108,426 files, encompassing employee records, employment and training information, confidential audit documents, and single sign-on source code. These descriptions reflect allegations and not authenticated findings from an investigation.
The screenshot from the leak site identifies a dataset labeled “pwc.com 590 GB Database,” claiming a total size of 590.69GB distributed across 108,426 files in 494 directories, along with 1,386 archive containers containing 19,324 files. These figures illustrate the attacker’s inventory and should not be interpreted as independently validated totals.
The listing references the directory “pwc-stg.csod.com”. It describes internal corporate learning data, materials related to the Cornerstone OnDemand platform, regional HR exchanges, e-learning courses, and documents for integration testing and maintenance. This reference alone does not confirm whether access involved PwC’s infrastructure, a service provider, or another environment.
Additional reporting by Hackmanac attributes the alleged data to several regional operations, including Australia, China, Canada, and the United Kingdom. It also notes one HR dataset containing 213,084 records. However, this figure does not definitively indicate how many unique individuals were affected.
The screenshot displays a countdown with approximately five days remaining. It warns that the files will be published when the timer expires. It also states that the company has time to contact the attackers, implying that the alleged data is being used as leverage for extortion.
However, the image does not indicate when it was captured or provide a reliable publication deadline. Furthermore, a listing on the leak site does not show that ransomware encrypted any systems, disrupted business operations, or that the claimed files are authentic. 🚨 BREAKING: Everest hacking group claims to have stolen 590 GB of data from PwC, one of the Big Four auditing firms.
The allegedly stolen data spans 108,426 files from internal HR and learning systems, including employee records, employment and training data, confidential audit… pic.twitter.com/FCvnF27zjf
— Crypto India (@CryptooIndia) October 22, 2026
Current reports do not clarify the initial access vector, exploited vulnerabilities, malware payload, or confirmed indicators of compromise. Monitoring services recorded the Everest listing on October 22, 2026, but tracking an attacker’s announcement does not validate a breach.
The central unanswered questions concern the data’s authenticity, the affected legal entities, and whether any production environment was accessed. Until corroborating evidence emerges, this incident should be reported as an alleged data theft and extortion claim, rather than a confirmed ransomware compromise.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.