The original text is in EN, taken from the source site. Source ↗

The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it.

A post shared by Crypto India states that the alleged theft includes 108,426 files, encompassing employee records, employment and training information, confidential audit documents, and single sign-on source code. These descriptions reflect allegations and not authenticated findings from an investigation.

The screenshot from the leak site identifies a dataset labeled “pwc.com 590 GB Database,” claiming a total size of 590.69GB distributed across 108,426 files in 494 directories, along with 1,386 archive containers containing 19,324 files. These figures illustrate the attacker’s inventory and should not be interpreted as independently validated totals.

The listing references the directory “pwc-stg.csod.com”. It describes internal corporate learning data, materials related to the Cornerstone OnDemand platform, regional HR exchanges, e-learning courses, and documents for integration testing and maintenance. This reference alone does not confirm whether access involved PwC’s infrastructure, a service provider, or another environment.

Additional reporting by Hackmanac attributes the alleged data to several regional operations, including Australia, China, Canada, and the United Kingdom. It also notes one HR dataset containing 213,084 records. However, this figure does not definitively indicate how many unique individuals were affected.

The screenshot displays a countdown with approximately five days remaining. It warns that the files will be published when the timer expires. It also states that the company has time to contact the attackers, implying that the alleged data is being used as leverage for extortion.

However, the image does not indicate when it was captured or provide a reliable publication deadline. Furthermore, a listing on the leak site does not show that ransomware encrypted any systems, disrupted business operations, or that the claimed files are authentic. 🚨 BREAKING: Everest hacking group claims to have stolen 590 GB of data from PwC, one of the Big Four auditing firms.

The allegedly stolen data spans 108,426 files from internal HR and learning systems, including employee records, employment and training data, confidential audit… pic.twitter.com/FCvnF27zjf

— Crypto India (@CryptooIndia) October 22, 2026

Current reports do not clarify the initial access vector, exploited vulnerabilities, malware payload, or confirmed indicators of compromise. Monitoring services recorded the Everest listing on October 22, 2026, but tracking an attacker’s announcement does not validate a breach.

The central unanswered questions concern the data’s authenticity, the affected legal entities, and whether any production environment was accessed. Until corroborating evidence emerges, this incident should be reported as an alleged data theft and extortion claim, rather than a confirmed ransomware compromise.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.