A PwC external vendor that hosts the accounting firm’s employee learning records was hit by a cyber incident.
The firm has confirmed the breach following statements by a cyber extortion group claiming to possess hundreds of gigabytes of company files.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
However, according to the professional services network, the incident occurred outside its primary IT infrastructure.
A PwC global spokesperson told International Accounting Bulletin: “We are aware of an incident involving a third-party PwC vendor site used to host PwC learning records.
“The affected site does not house client data, sensitive personal data or financial information. Once we learned of this incident, we acted promptly to secure the environment and conduct a thorough review.”
The firm stated that internal operations and client engagements remain uninterrupted. The spokesperson confirmed that the event “does not impact our network or any of our operations.”
The statement comes after a cyber extortion group known as Everest published claims last week that it had breached the firm’s data, according to research platform eCrime.ch.
The group displayed a five-day countdown clock on its website and indicated it would publish the files publicly if the parties did not reach an agreement.
Everest asserted that it acquired 590GB of material. The group claimed the files comprise “regional HR and learning exports, integration documentation, software components and PwC e-learning courses”, according to a Reuters report.
The group further stated that the records hold details “about individuals and their organisational and employment history,” specifying that the files include personal names, telephone numbers, postal addresses, and email addresses.
PwC did not verify the assertions made by the extortion group. The firm’s spokesperson declined to provide details regarding the volume of data involved or the accuracy of the group’s statements.
The incident comes after PwC Australia launched an AI-enabled cybersecurity service earlier this month for monitoring, threat detection and incident response.
