Short version: a ransom gang says it took 590 GB from PwC. PwC says it was a vendor site holding employee training records — and that nothing sensitive was in there. Both statements can be true, and the gap between them is the actual story 
The 60-second version
- 22 Oct — a criminal group called Everest puts PwC on its leak site (a dark-web page where extortion gangs dump stolen files to force a payment). Claim: 590.69 GB / 108,426 files, described as “regional HR and learning exports, integration documentation, software components and PwC e-learning courses.” A 5-day countdown was posted: pay, or it all goes public.
- 23 Oct — PwC tells Reuters it is aware of an incident at “a third-party vendor used to host company employee learning records” (an outside company that runs their staff-training system). Their line: “The affected site does not house client data, sensitive personal data or financial information… does not impact our network or any of our operations.”
- PwC declined to name the vendor, declined to confirm the size, and declined to confirm Everest’s claims are true at all.
What nobody said out loud
PwC wouldn’t name the vendor. The folder name inside Everest’s own screenshot does the naming: pwc-stg.csod.com.
csod.com→ Cornerstone OnDemand, one of the biggest workplace learning platforms (an LMS — the software a company runs its staff courses on)stg→ staging, a test copy of a system, kept between changes before they go livepwc-→ PwC’s own tenant (their private slice of someone else’s software)
Independent researchers at Cloudskope resolved that hostname on 24 Oct and found it still online, sitting behind PwC’s single sign-on (one login for all their apps). So the site PwC described as harmless is a test environment of their training platform — reachable from the open internet.
Why this is bigger than “another leak”
- Training platforms are HR databases in disguise — names, work emails, phones, addresses, job history, org charts, who passed what.
- They sit outside the audits — PwC certifies other companies’ security controls; a vendor-hosted training tenant appears in none of those reports.
- Test copies escape the rules — real staff records get copied into staging so the tests look real, and staging is usually the copy nobody watches.
- Course libraries are products — “PwC e-learning courses” aren’t flyers, they are licensed paid content. That is why this one lands differently for anyone who builds or sells courses.
Claim vs confirmed
| Everest (claims) | PwC (said publicly) | |
|---|---|---|
| What was hit | internal HR + learning systems | a vendor site holding employee learning records |
| Volume | 590.69 GB / 108,426 files | not commented |
| Contents | HR exports, integration docs, software components, e-learning courses, staff contact + employment history | “no client data, sensitive personal data or financial information” |
| Impact | not stated | “does not impact our network or any of our operations” |
| Deadline | 5-day countdown from 22 Oct (≈ 27 Oct) | — |
60-second check for your own org
- Find out who hosts your LMS, then ask them for the full tenant list —
-stg,-pilot,-sandboxincluded. - Ask which of those answer on the public internet. “Behind SSO” is fine. “It’s just a test box, nobody looks” is not.
- Locate your HR/training exports — the CSV/ZIP dumps. That is what gets stolen, not the pretty dashboard.
- Assume staff contact details will leak eventually, and know what your org does on that day.
What to watch in the next 72 hours
That countdown runs out around 27 Oct. The usual pattern: a sample of files first, then the full dump. The part that really matters is quieter — whether a regulator forces a notification (GDPR-style 72-hour reporting, US state breach laws). “No sensitive personal data” is exactly the sentence that can mean employees never get a letter.
Over to you
- If your employer runs Cornerstone, do you know whether you have a
-stgtenant sitting online? - If 590 GB of staff contact details and employment history isn’t “sensitive personal data”, what is?
- Course creators here: would your library survive a leak like this?
Sources
- Reuters (original): https://www.reuters.com/legal/litigation/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-2026-10-23/
- Free mirror: https://www.channelnewsasia.com/business/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-6487381
- Vendor + hostname analysis: https://www.cloudskope.com/insights/post/pwc-data-breach-2026-everest-cornerstone-learning-records
- Claim still unverified: https://cypro.co.uk/insights/cyber-bulletins/everest-pwc-claim-remains-unverified/
Size, contents and countdown are the gang’s claims until a file is verified. PwC’s one-liner is not proof either.
!