PwC Confirms Vendor-Hosted Learning Records Incident After Everest Extortion Claim

Updated October 24, 2026, 2:30 AM CT. PwC has confirmed a cybersecurity incident at a third-party vendor that hosts employee learning records. It has not named the vendor, given dates or said how many people are affected. The directory name shown in the extortion group's screenshot corresponds to a Cornerstone OnDemand staging tenant bearing PwC's name, which Cloudskope found still online behind PwC's single sign-on.

Full analysis: PwC Won't Name the Vendor. Everest's Screenshot Does. It Says Staging.

On October 22, 2026, the Everest extortion group listed PwC on its leak site and claimed 590.69 GB of HR and learning-system data. The next day PwC told Reuters that "the affected site does not house client data, sensitive personal data or financial information" and that the incident "does not impact our network or any of our operations." PwC declined to say how much data was taken or whether Everest's description is accurate.

Timeline (Central Time)

• October 19, 2026. PwC reports FY26 aggregate gross revenue of US$60.2 billion and "more than 360,000 people." No incident is mentioned.
• October 22, 8:10 AM. Everest's PwC listing is recorded by the ransomware.live tracker (13:10 UTC), country Great Britain. Reuters, citing eCrime.ch, dates the post to October 22 and reports a countdown with five days remaining.
• October 22, afternoon. CyPro's bulletin finds no PwC statement and no independent evidence.
• October 23, 12:12 AM. Cybersecurity News publishes Hackmanac's figures and the screenshot details, including a directory named pwc-stg.csod.com and a reported October 28 release date it could not confirm.
• October 23. Reuters (AJ Vicens) reports PwC's confirmation of an incident involving "a third-party vendor used to host company employee learning records."
• October 24, 1:57 AM. Cloudskope confirms pwc-stg.csod.com resolves to a Cornerstone staging cluster and redirects to PwC's SAML sign-on. Cornerstone's trust center carries no incident notice.

What PwC has said

"The affected site does not house client data, sensitive personal data or financial information."

"Once we learned of this incident we acted promptly to secure the environment and conduct a thorough review."

PwC has not published a statement on pwc.com that we could find. It has not named the vendor.

What Everest claims (unverified)

• 590.69 GB and 108,426 files from internal HR and learning systems (Hackmanac).
• Regional HR and learning exports, integration documentation, software components and e-learning courses (Reuters).
• Personal data: names, email addresses, phone numbers, addresses, employment history (Reuters).
• Per Hackmanac as reported by Cybersecurity News: employment and training records, internal audit methods, confidential documents, single sign-on source code and configuration files; regions including Australia, China, Canada and the UK; one HR dataset of 213,084 records.

What is still unknown

• Which vendor. PwC has not named it; Cornerstone has issued no public statement we could find.
• Which environment: production, staging, pilot or sandbox.
• Whether the vendor's platform was compromised or a PwC-side credential or integration account was used.
• When access began and ended, and when PwC learned of it.
• How many people, in which countries, and whether former staff and candidates are included.
• Whether the UK ICO or other data protection authorities have been notified.
• Whether any data has been published.

Confirmed by Cloudskope's direct observation (October 24, 1:56 to 2:07 AM CT)

• pwc-stg.csod.com is a CNAME to glb-llsstg01-db2005.cdn-ext.csod.com, served through Amazon CloudFront. PwC's production tenant, pwc.csod.com, resolves to glb-llpprd01-l3f; pwc-pilot.csod.com and pwc-sandbox.csod.com also exist.
• The staging tenant answers with an HTTP 302 to samldefault.aspx, then a SAML error (SAML Assertion Missing). It is internet-reachable and fronted by single sign-on. No login was attempted.
• Staging tenants are a standard Cornerstone construct; another large customer's staging hostname also resolves.
• Certificate transparency shows no PwC-specific certificates under csod.com.
• Cornerstone's public trust center lists "Environment Segregation" and "Data Breach Notifications" controls and carries no incident notice; its newest public update is dated September 28, 2026.

Inference, stated as inference

The directory name matches a live staging tenant, which makes Cornerstone OnDemand the obvious candidate for the vendor. Everest describes HR exports, integration documentation and single sign-on configuration, which is the material an administrator typically loads into staging to test feeds and sign-on changes. Whether real employee data was in staging is the central open question.

Technique mapping (conditional; no indicators published)

• If a valid account was used: MITRE ATT&CK T1078.004, Valid Accounts: Cloud Accounts.
• If access came through the vendor: T1199, Trusted Relationship.
• Collection: T1213, Data from Information Repositories. Extortion: T1657, Financial Theft.

Cornerstone OnDemand has been owned by Clearlake Capital since 2021. Its loans are held by public business development companies: Ares Capital marked a $137.5 million second-lien loan at $88.0 million on June 30, 2026, from $125.1 million six months earlier, and Blue Owl Technology Finance marked its $71.7 million slice at $41.2 million. Those marks predate the incident and are not evidence of a cause, but they are a free public signal of vendor stress. Diligence teams should inventory a target's non-production SaaS tenants and the integration accounts that feed them.