PwC Confirms Cyber Incident at Learning Records Vendor

PwC says it is aware of a cybersecurity incident at a third-party vendor that hosts its employees’ learning records. A PwC global spokesperson told Reuters on Friday 23 October that the affected site holds no client or financial data, and that the incident does not affect the firm’s own network or operations.

The statement came a day after a cyber extortion group called Everest claimed to have stolen 590 gigabytes of PwC data. PwC declined to comment on that figure or on whether the group’s claims are true, and the claim has not been independently verified.

PwC says the affected site holds no client or financial data

PwC, one of the world’s largest accounting and consulting firms, has not named the vendor or said when it learned of the incident. Its spokesperson described the affected system as a site run by a third party “used to host company employee learning records”, the training and course history the firm keeps on its staff.

“The affected site does not house client data, sensitive personal data or financial information,” the spokesperson said. “Once we learned of this incident we acted promptly to secure the environment and conduct a thorough review.” The incident “does not impact our network or any of our operations,” the spokesperson added.

PwC has not said how the vendor’s site was accessed, how many people’s records it held, or whether the review has found that any data was taken.

Everest’s claim of 590GB has not been verified

Everest claimed responsibility in a message posted to its website on 22 October, according to the cybercrime research platform eCrime.ch, Reuters reported. The group says it took 590 gigabytes of data, including “regional HR and learning exports, integration documentation, software components and PwC e-learning courses”.

Everest also says the data covers “individuals and their organisational and employment history”, including names, email addresses, telephone numbers and addresses. Those are the group’s words, not PwC’s. “The PwC spokesperson declined to comment on the amount of data stolen or the veracity of the hacking group’s claims,” Reuters reported.

Cybernews, which also saw the listing, reported that the gang “has not published proof” and that “The attackers have not published sample files to back up their claims so far.”

Suppliers have been a common way in this month

PwC’s account fits a pattern TSN has tracked through October: incidents that start at a supplier rather than inside the named organisation. Japan’s Digital Agency said this week that a breach at its website vendor may have exposed more than 13,000 contact-form entries. In the US, a cyber incident at BAE Systems halted notices from the federal bankruptcy courts, because BAE runs the noticing system for the judiciary. IT services firm ConnectWise reset credentials after an incident took its cloud backup service offline.

Everest has made claims like this before. In April, Cybernews reported, the group claimed to have taken 3.4 million customer records from Citizens Bank, which confirmed a breach and said the data had been taken from a third-party vendor. That figure was also the group’s own.

PwC’s short statement leaves the key questions open

PwC moved quickly to put limits on the story. Within a day of Everest’s post, it had confirmed an incident, placed it at a supplier, and said the system involved held no client, financial or sensitive personal data. For a firm whose business rests on handling clients’ confidential information, those are the points that matter most, and on PwC’s account the damage stops short of them.

But the statement is narrow, and it answers only some of the questions the claim raises. PwC has not said what the learning-records site did hold, or how many staff it covered. Its description and Everest’s are hard to square without more detail: the group talks about contact details, employment history and integration documents, while PwC talks only about learning records. Neither account can be checked from the outside, and PwC has declined to address the group’s figures at all.

The supplier angle also cuts both ways. Keeping training records with a vendor may have kept the incident away from PwC’s own network, as the firm says. But the vendor still held data about PwC’s people, and staff will want to know whether theirs was among it. PwC’s review should be able to say that. Until it does, the only detailed account of what was taken is the extortion group’s own.