PwC confirms cybersecurity incident involving employee learning records

Oct 23 — PwC on Friday said it was aware ​of a cybersecurity incident involving a third-party vendor used to host company employee learning records, the ‌day after a cyber extortion group claimed to have stolen 590 gigabytes ⁠of company data.

• A ​PwC global spokesperson said "the ⁠affected site does not house client data, sensitive personal ‌data or financial ‌information. Once we learned of this incident we ⁠acted promptly to secure ⁠the environment and conduct a thorough review."

• The incident "does not impact our network or any of our operations," the spokesperson said.

• A cyber extortion group called "Everest" claimed responsibility for the data breach in a ‌message posted to its website October ​22, according to cybercrime research platform eCrime.ch. The message included a countdown timer with five days remaining, and a message indicating the data would be released if a deal could not be reached.

• Everest claimed to have stolen 590 gigabytes of data ​that included "regional HR and learning exports, integration documentation, software ‌components and PwC ‌e-learning ⁠courses."

• The data contains information "about individuals and their organisational and employment history," Everest said, including names, email addresses, telephone numbers, addresses and other details.

• The PwC spokesperson declined ‌to comment on ​the amount of data stolen ‌or the veracity of ⁠the ​hacking group's claims.

(Reporting by AJ Vicens in Detroit; Editing by ​Chris Reese)

Related topics