PwC has confirmed a cybersecurity incident involving a third-party vendor that hosts employee learning records, while a cyber-extortion group claims it obtained hundreds of gigabytes of data.
PwC said the affected environment does not contain client data, sensitive personal data or financial information and that the incident did not affect the firm’s network or operations.
The cyber-extortion group Everest claimed responsibility and said it stole approximately 590 gigabytes of data.
According to the group’s claims reported by Reuters, the material included regional human-resources and learning exports, integration documentation, software components and e-learning material.
The group also claimed some records contained names and employment-related information.
PwC has not confirmed the amount allegedly stolen or validated the hacking group’s description of the material.
That distinction remains important because the attackers’ claims have not been independently established.
The incident highlights continuing third-party cybersecurity risk for large professional-services organizations.
Companies can maintain strong controls over their primary networks while remaining exposed through vendors that host employee, customer or operational systems.
Supply-chain and third-party vulnerabilities have become an increasingly important cybersecurity concern because attackers can potentially reach large organizations without directly breaching their primary infrastructure.
The immediate financial consequences remain unclear.
Markets and clients will watch the investigation for confirmation of what information was actually accessed, whether regulators become involved and whether the vendor incident creates additional remediation costs.
