# 590 GB from a training site: what the PwC leak really exposed **URL:** \ **Category:** News & Articles\ **Tags:** learning, hacking, privacy\ **Created:** [October 25, 2026, 7:55pm UTC](https://onehack.st/t/590-gb-from-a-training-site-what-the-pwc-leak-really-exposed/326748 "2026-10-25T19:55:55Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Adryan\_MacArthur](https://onehack.st/user_avatar/onehack.st/adryan_macarthur/32/128912_2.png) [@Adryan\_MacArthur](https://onehack.st/u/Adryan_MacArthur)\ **Post date:** [October 25, 2026, 7:55pm UTC](https://onehack.st/t/590-gb-from-a-training-site-what-the-pwc-leak-really-exposed/326748/1 "2026-10-25T19:55:55Z")
**Short version:** a ransom gang says it took 590 GB from PwC. PwC says it was a vendor site holding employee _training_ records — and that nothing sensitive was in there. Both statements can be true, and the gap between them is the actual story 👇 ### The 60-second version - **22 Oct** — a criminal group called **Everest** puts PwC on its leak site (a dark-web page where extortion gangs dump stolen files to force a payment). Claim: **590.69 GB / 108,426 files** , described as _“regional HR and learning exports, integration documentation, software components and PwC e-learning courses.”_ A **5-day countdown** was posted: pay, or it all goes public. - **23 Oct** — PwC tells Reuters it is aware of an incident at _“a third-party vendor used to host company employee learning records”_ (an outside company that runs their staff-training system). Their line: _“The affected site does not house client data, sensitive personal data or financial information… does not impact our network or any of our operations.”_ - PwC **declined to name the vendor** , declined to confirm the size, and declined to confirm Everest’s claims are true at all. ### What nobody said out loud PwC wouldn’t name the vendor. The folder name inside Everest’s own screenshot does the naming: `pwc-stg.csod.com`. - `csod.com` → **Cornerstone OnDemand** , one of the biggest workplace learning platforms (an LMS — the software a company runs its staff courses on) - `stg` → **staging** , a _test copy_ of a system, kept between changes before they go live - `pwc-` → PwC’s own tenant (their private slice of someone else’s software) Independent researchers at Cloudskope resolved that hostname on 24 Oct and found it **still online** , sitting behind PwC’s single sign-on (one login for all their apps). So the site PwC described as harmless is a **test environment of their training platform — reachable from the open internet.** ### Why this is bigger than “another leak” 1. **Training platforms are HR databases in disguise** — names, work emails, phones, addresses, job history, org charts, who passed what. 2. **They sit outside the audits** — PwC certifies other companies’ security controls; a vendor-hosted training tenant appears in none of those reports. 3. **Test copies escape the rules** — real staff records get copied into staging so the tests look real, and staging is usually the copy nobody watches. 4. **Course libraries are products** — “PwC e-learning courses” aren’t flyers, they are licensed paid content. That is why this one lands differently for anyone who builds or sells courses. ### Claim vs confirmed | | Everest (claims) | PwC (said publicly) | | --- | --- | --- | | What was hit | internal HR + learning systems | a _vendor_ site holding employee learning records | | Volume | 590.69 GB / 108,426 files | not commented | | Contents | HR exports, integration docs, software components, e-learning courses, staff contact + employment history | “no client data, sensitive personal data or financial information” | | Impact | not stated | “does not impact our network or any of our operations” | | Deadline | 5-day countdown from 22 Oct (≈ 27 Oct) | — | ### 60-second check for your own org 1. Find out **who hosts your LMS** , then ask them for the _full_ tenant list — `-stg`, `-pilot`, `-sandbox` included. 2. Ask which of those answer on the **public internet**. “Behind SSO” is fine. “It’s just a test box, nobody looks” is not. 3. Locate your **HR/training exports** — the CSV/ZIP dumps. That is what gets stolen, not the pretty dashboard. 4. Assume staff contact details will leak eventually, and know what your org does on that day. ### What to watch in the next 72 hours That countdown runs out around **27 Oct**. The usual pattern: a sample of files first, then the full dump. The part that really matters is quieter — whether a regulator forces a **notification** (GDPR-style 72-hour reporting, US state breach laws). “No sensitive personal data” is exactly the sentence that can mean employees never get a letter. ### Over to you - If your employer runs Cornerstone, do you know whether you have a `-stg` tenant sitting online? - If 590 GB of staff contact details and employment history isn’t “sensitive personal data”, what is? - Course creators here: would _your_ library survive a leak like this? **Sources** - Reuters (original): [https://www.reuters.com/legal/litigation/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-2026-10-23/](https://www.reuters.com/legal/litigation/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-2026-10-23/) - Free mirror: [https://www.channelnewsasia.com/business/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-6487381](https://www.channelnewsasia.com/business/pwc-confirms-cybersecurity-incident-involving-employee-learning-records-6487381) - Vendor + hostname analysis: [https://www.cloudskope.com/insights/post/pwc-data-breach-2026-everest-cornerstone-learning-records](https://www.cloudskope.com/insights/post/pwc-data-breach-2026-everest-cornerstone-learning-records) - Claim still unverified: [https://cypro.co.uk/insights/cyber-bulletins/everest-pwc-claim-remains-unverified/](https://cypro.co.uk/insights/cyber-bulletins/everest-pwc-claim-remains-unverified/) > ⚠ Size, contents and countdown are the gang’s **claims** until a file is verified. PwC’s one-liner is not proof either.