Microsoft partner PwC is facing data breach claim

PwC has been targeted by a ransomware gang that claims to have stolen 590GB of its data, including employees' personal identification numbers worldwide.

Global professional services giant PwC has appeared on the dark web leak site of the Everest ransomware gang, which claims to have stolen 590GB of company data and has given the firm four days to begin negotiations.

Ransomware groups commonly use these tactics to pressure victims into paying the ransom. The attackers have not published sample files to back up their claims so far.

However, the gang claims to have obtained employees' personal information from offices worldwide, along with a treasure trove of corporate data.

According to the gang’s claims, the stolen information is recent, with many records dating back to 2026.PwC, headquartered in London, is one of the world's largest professional services firms, providing auditing, consulting, tax, and advisory services to organizations around the globe.

The company works with such major companies as Microsoft, SAP, National Grid, and Grande Cheese.

What PwC data is allegedly breached?

In a post, the Everest Group stated that the dataset includes:

• Employee personal information: names, emails, phone numbers, addresses, job titles, managers, hire and departure dates.
• National identity and tax numbers: Mexican CURP, RFC, IMSS, and INFONAVIT numbers linked to employee profiles
• Sensitive employment statuses: maternity, parental leave, long-term sickness, terminated, and deceased records across multiple countries
• Learning and training history: hundreds of millions of rows of course completions, scores, exemption reasons, withdrawal comments, and no-show records
• PwC audit methodology: proprietary training courses covering Aura workflows, audit planning, risk assessment, IFRS 9/15, ISA, and PCAOB standards
• Real client engagement data: five named client engagements with partner, manager, and team contact details embedded in a Canadian training course
• Budget and engagement reference lists: ~2,000 client names, ~20,000 engagements, ~17,700 resource names, and US service codes
• Source code: C# and Java SSO implementations, a full Vantage browser application, and 721 JavaScript files from e-learning packages
• Encryption keys and access credentials: AES encryption config for SSO, ESS Pin Codes, and SFTP transfer settings
• Confidential integration specs: three documents marked CONFIDENTIAL describing PwC–Cornerstone data exchange architecture across 86 tables
• External training costs: course fees, PwC-covered costs, repayment obligations, and provider details
• GDPR user deletion lists: 77,246 user GUIDs flagged for deletion, with no confirmation that the deletions were executed
• Instructor records: 318,933 rows with names, user IDs, and email addresses
• 6,863 encrypted OpenPGP files: contents unknown without private keys
• Operational logs: platform execution logs from 2026 and historical error logs from 2015–2017

Risk of fraud and social engineering attacks

Such data, if proves to be legitimate is a goldmine for attackers. wC works with businesses across a wide range of industries, making the security of its internal systems important not only to the firm itself but also to the organizations that rely on its services.

Criminals could exploit stolen data to commit fraud. Also, they could use it to launch convincing phishing attacks that spread malware or trick employees into handing over even more sensitive data.

Exposed credentials and internal technical documents could also put corporate systems at risk, while stolen audit materials could reveal confidential business information.

We reached out to PwC for more information, and we will update the article once response is received.