PwC confirms cyberattack at the vendor that manages its employee training

On October 22, the extortion group Everest added PwC, one of the world's four big audit and consulting firms, to the list of victims displayed on its site. The post came with a five-day countdown and a threat: publish the data if no agreement is reached.

The next day, Friday, October 23, PwC told Reuters it was aware of a cybersecurity incident at a vendor that hosts its employees' training records. According to a global spokesperson for the firm, the affected site contains “no client data, no sensitive personal data and no financial information.” PwC says neither its network nor its operations are affected, and says it acted quickly to secure the environment concerned and to carry out a thorough review.

What the files allegedly contain

Everest says it stole 590 GB of data. According to its claim, reported by Reuters, the set includes regional human resources and training exports, technical onboarding documentation, software components and PwC online courses. The group says it includes names, email addresses, phone numbers, addresses and career histories.

None of this is confirmed. The PwC spokesperson declined to comment on the claimed volume or on the accuracy of the group's assertions. PwC has not said who the vendor is, how many employees are affected, which countries are involved, or how the hackers got in. According to Cybersecurity News, a screenshot of the claim refers to the Cornerstone OnDemand platform, and Hackmanac's alert mentions data linked to Australia, China, Canada and the United Kingdom.

The vendor, a recurring weak link

The pattern is becoming familiar: the targeted company is not hacked itself, but one of its suppliers is. That is what happened this fall to Malakoff Humanis, whose vendor was attacked in August.

A training platform looks harmless. Yet it often holds the company directory: names, job titles, departments, managers, contact details. For preparing targeted phishing, that is a valuable starting point, even without any client data.

Good practices

Employees of a firm or company whose supplier has been hit should be wary of messages about a training course to complete, a certificate to download or an HR record to update. A credible context is exactly what an attacker is looking to exploit.

For companies, the incident is a prompt to review the inventory of online services that hold employee data, not just those that hold client data. You need to know what information each one stores, since when, and what the contract provides for in case of an incident.

One deadline remains: the end of the countdown displayed by Everest. If the files are published, it will finally be possible to judge the gap between the claim and PwC's account.