PwC has confirmed a cybersecurity incident involving a third-party provider that hosts employee learning records, after a cyber-extortion group claimed to have stolen approximately 590 gigabytes of company data.
According to Reuters, the Everest group claimed responsibility for the breach on 22 October, alleging that it had obtained human resources and training records, integration documentation, software components and PwC e-learning materials.
The group also claimed the information included employees’ names, email addresses, telephone numbers, addresses and employment histories.
PwC has not verified the group’s claims or confirmed how much information, if any, was stolen.
A PwC global spokesperson confirmed that the incident involved an external platform used to store employee learning records, but said the affected site did not contain client data, sensitive personal information or financial information.
The firm said it had acted promptly to secure the environment and investigate the incident. It maintained that its own network and business operations were unaffected.
According to Cybersecurity Dive, PwC was continuing to investigate the claims surrounding the incident.
Another Third-Party Security Incident
The PwC incident follows a confirmed data breach at EY earlier this year, also involving an external technology platform. An unauthorised party accessed a third-party IT support platform used by EY’s tax teams and downloaded documents containing sensitive client information.
Unlike the PwC incident, where the alleged theft remains unverified, EY confirmed that client documents had been accessed and downloaded.
Questions Remain Over Alleged Data Theft
Everest’s original notice reportedly included a five-day countdown, threatening publication of the allegedly stolen PwC information if its demands were not met.
As of 27 October, there was no independently verified confirmation that the threatened publication had occurred.
PwC has not publicly identified the affected vendor or disclosed how the incident occurred.
Both incidents highlight the risks facing professional services networks that rely on external technology providers to store and manage information, even when their own central systems remain uncompromised.
Want to stay up to date on all things Big Four around the world?
Check out the News section and subscribe to Big4News for weekly deep dives and briefings.
To keep up with technology at Deloitte, PwC, EY and KPMG? Start here →
https://www.big4news.com/t/technology-and-ai
About the author: Claudine Cassar is the founder and editor of Big4News, covering audit, consulting, regulation and governance across Deloitte, PwC, EY and KPMG.