PwC confirmed on Friday, the 23rd, that it is aware of a digital security incident involving a third-party supplier responsible for hosting its employee training records. One day earlier, a cyber extortion collective alleged having stolen 590 GB of the corporation's data.
A global company spokesperson clarified that the affected system does not store customer data, confidential financial information, or sensitive personal data. PwC stated that it has implemented measures to secure the environment and has begun investigating the occurrence.
The representative also assured that PwC's internal network and operational activities were not affected. However, the company chose not to comment on the actual amount of allegedly stolen data nor to ratify the claims made by the intruders.
The digital extortion group known as Everest claimed responsibility for the incident in a post made on its own website on Thursday, the 22nd, according to research platform iCrime.ch on cybercrimes.
The message sent by Everest contained a five-day countdown and a threat to release the files if an agreement was not reached with the company. The group claimed to have gained access to 590 GB of information, which includes human resources and training materials, as well as system integration documentation, software components, and PwC's digital learning courses.
According to the criminal group, this material covers data of individuals and their respective professional and organizational histories. Among the cited data were names, email addresses, phone numbers, and residential locations.
However, as of now, there is no independent confirmation that the entire volume of alleged data was actually stolen or whether the files described by the group correspond to the content of the compromised systems. PwC has not yet disclosed the extent of any possible data leak.