# PwC Confirms Employee Learning Data Breach via Third-Party Vendor Professional services firm secures environment after ransomware group claims theft of internal records. - **Source:** [HR Dive](https://www.hrdive.com) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/924830e9-841a-455a-bcf5-d7314bb77bfd ## Third-Party Vendor Security Breach PwC confirmed a security breach involving a third-party vendor platform used for storing employee learning records. The firm initiated an immediate investigation after claims emerged regarding unauthorized access to this specific external environment. While the investigation continues, the company maintains that the incident remained isolated from its primary corporate network and internal systems. ## Ransomware Group Claims Responsibility The Everest ransomware group publicly claimed responsibility for the attack, alleging they successfully exfiltrated 590 gigabytes of internal employee data. Although PwC acknowledged the breach of the vendor site, the firm has not provided specific commentary regarding the validity of the ransomware group's claims or the total volume of data involved. ## Scope of Compromised Information PwC stated that the compromised vendor site did not contain sensitive client data, financial information, or critical personal records. The exposure was limited to employee learning documentation stored on the external platform. The firm emphasized that its core operational network and client-facing services were not impacted by this specific security event. ## Immediate Remediation Measures Following the discovery of the breach, PwC acted promptly to secure the affected environment and conducted a comprehensive review of the vendor's security protocols. The firm is working to ensure that all third-party connections meet their internal safety standards. This rapid response was intended to prevent further unauthorized access to any data. ## Profile of Everest Ransomware The Everest ransomware group has been active since late 2020, frequently operating as an initial access broker. Research indicates the group provides stolen credentials to other malicious actors and actively recruits insiders through profit-sharing incentives. Their recent activity includes targeting critical infrastructure providers and various international airports, demonstrating a broad operational scope. ## Global Operational Context Headquartered in London, PwC operates as one of the world's largest professional services firms, employing over 364,000 workers globally. Managing such a vast workforce requires extensive reliance on third-party vendors for training and administrative tasks. This incident highlights the inherent risks associated with managing distributed data across multiple external service provider platforms. ## Third-Party Risk Management Challenges The incident underscores the persistent vulnerability of large enterprises to supply chain attacks. Even when primary networks are robustly defended, third-party vendors often serve as entry points for threat actors. Organizations must continuously audit the security posture of all external partners to mitigate risks associated with shared data and integrated software environments. ## Strategic Security Implications This breach serves as a reminder that vendor risk management is a critical component of modern cybersecurity strategy. As ransomware groups evolve their tactics to include insider recruitment and credential brokering, firms must prioritize strict access controls. Protecting employee data remains as vital as safeguarding client information to maintain organizational integrity and trust. ## Sources covering this story - https://www.hrdive.com/news/pwc-learning-records-breached-attack-vendor/873019/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._