PwC Won't Name the Vendor. Everest's Screenshot Does. It Says Staging.

1:57 AM Central

At 1:57 AM Central on Saturday, October 24, Cloudskope sent one ordinary web request to a hostname called pwc-stg.csod.com. The response was an HTTP 302 redirect to a single sign-on page, carrying response headers that identify the software behind it as Cornerstone OnDemand's web application. Fifteen seconds later the sign-on page returned its own error, the one any visitor without a PwC identity would get: SAML Assertion Missing.

That hostname matters because of where it was seen first. On Thursday, October 22, at 8:10 AM Central, the Everest extortion group added PricewaterhouseCoopers to its leak site. According to Hackmanac and to Cybersecurity News, which described the screenshot Everest supplied, the claim covers 590.69 GB in 108,426 files, described as internal HR and learning-system data, and one of the directories shown is named pwc-stg.csod.com. The csod.com domain belongs to Cornerstone OnDemand, the learning and talent-management software company. The stg is the conventional abbreviation for staging.

The next day PwC confirmed an incident to Reuters. A spokesperson said it involved a third-party vendor used to host employee learning records, and that "the affected site does not house client data, sensitive personal data or financial information." PwC did not name the vendor. It declined to say how much data was taken or whether Everest's description was accurate.

So the public record, as of Saturday morning, has three parts. A Big Four network with more than 360,000 people says a vendor-hosted site was involved and that nothing sensitive was there. The extortion group's own screenshot points, by hostname, to a staging tenant on Cornerstone's platform. And that tenant is still on the internet, behind PwC's sign-on, answering requests.

The incident is not the story. Data about professional-services employees gets stolen every week. The story is the distance between the sentence PwC chose and the hostname Everest showed; what a staging environment is supposed to contain and what this one is claimed to have contained; why U.S. notification law may never require PwC to file a letter about it; and who, in the end, carries the risk of a learning platform that sits outside every client attestation PwC signs. That last answer runs through a 2021 private equity buyout and a set of loan marks that private-credit lenders cut by roughly a third in the first half of this year, before anyone had heard of this incident.

What we verified, and what the first reports could not

Cloudskope ran passive checks against public infrastructure between 1:56 and 2:07 AM Central on October 24. Nothing below involved a login attempt, a credential, or any request beyond what a browser makes when it loads a page. We did not visit Everest's leak site, which is hosted on Tor, and we did not open the screenshot Everest posted. Everything we say about what that screenshot shows comes from Hackmanac and Cybersecurity News, and is labeled that way.

The listing. The ransomware.live tracker records Everest's PwC post as discovered at 13:10:19 UTC on October 22, which is 8:10 AM Central, with the country field set to Great Britain and no data size or ransom amount recorded. The same tracker holds three earlier PwC listings: two by Clop during the 2023 MOVEit campaign (June 23 and July 19, 2023, the second under a clear-web domain spelled PWCCLINETSANDDOCUMENTS.COM) and one by the short-lived Dispossessor group in August 2024.

The tenant exists. DNS over HTTPS at 1:57 AM Central resolved pwc-stg.csod.com as a CNAME to glb-llsstg01-db2005.cdn-ext.csod.com, then to an Amazon CloudFront distribution. PwC's production tenant, pwc.csod.com, resolves to a different cluster label, glb-llpprd01-l3f. A third tenant, pwc-pilot.csod.com, resolves to glb-llppil01-db1001, and a fourth, pwc-sandbox.csod.com, to a production-labelled cluster, glb-llpprd01-l1i. We read "sstg," "pprd" and "ppil" as staging, production and pilot. That reading is ours; Cornerstone does not publish its naming scheme.

Staging tenants are normal. To check whether a staging tenant is a PwC peculiarity, we resolved the obvious names for the other three Big Four firms. One other firm's staging hostname also resolves to a Cornerstone staging cluster. We mention that only to establish that "-stg" tenants are a standard Cornerstone construct, provisioned for customers to test configuration before it reaches production. It implies nothing about that firm. EY and Deloitte do not resolve on csod.com under those names at all.

The tenant is live. At 1:57 AM Central, https://pwc-stg.csod.com/ returned HTTP/2 302 to samldefault.aspx, with headers naming a Kong API gateway and Cornerstone's web forms. The SAML entry point then returned a redirect to an error page reading SAML Assertion Missing. PwC's production tenant behaved the same way to the first request, and its SAML entry point returned a different error: Object reference not set to an instance of an object, which is a .NET runtime exception surfacing in a URL. Both tenants are internet-reachable and fronted by single sign-on. A re-check at 8:25 AM Central returned the same redirect from the staging tenant. We did not, and would not, test whether either accepts anything else.

The certificate trail is blank. Certificate transparency logs hold 1,125 certificates for csod.com hostnames. None names a PwC host. The CT data suggests Cornerstone serves customer tenants under a wildcard certificate, in which case CT logs cannot tell anyone when PwC's staging tenant was created. Our workspace's egress proxy re-terminates TLS, so we could not independently record the live certificate.

The vendor has issued no public statement we could find. At 2:02 AM Central we captured Cornerstone's public trust center, which runs on SafeBase (page hash recorded in our evidence file). It carries no incident notice. Its newest public update, dated September 28, announces a white paper on "Cornerstone's Security Readiness in the Age of AI" with the line "As cyber threats move at machine speed, so do we." The trust center lists an "Environment Segregation" control and a "Data Breach Notifications" item, both marked at full maturity. The page source contains no occurrence of the words staging, sandbox, non-production or test environment.

Nor has PwC, on its own site. We found no statement on pwc.com, though PwC's global, UK and U.S. newsrooms refused our scripted requests with HTTP 403, so we could not check them fully. The most recent dated PwC release we could read is its FY26 results, issued October 19, three days before Everest's post: US$60.2 billion in aggregate gross revenue and "more than 360,000 people." PwC's only public statement on this incident is the one its spokesperson gave Reuters.

No filing anywhere. EDGAR full-text search returned no Item 1.05 cybersecurity 8-K from any registrant between October 20 and 24. Cornerstone has been private since 2021 and PwC is a partnership network; neither files 8-Ks. Cornerstone's lenders do file with the SEC, and we come back to them below.

What we could not verify is most of what matters. We cannot confirm that Cornerstone is the vendor PwC means; the directory name and the live tenant make it the obvious candidate, and PwC could settle it in one word. We cannot say whether Cornerstone's platform was compromised or whether someone used a PwC-side credential or integration account to pull data out of PwC's own tenant. Those are different incidents with different owners. We cannot say whether the staging tenant held copies of real employee data. And we cannot verify any number Everest has published.

What PwC said, read one sentence at a time

PwC's statement to Reuters is short, and each clause is doing a specific job.

"The affected site does not house client data, sensitive personal data or financial information."

Start with the noun. Site, singular. Not platform, not vendor, not environment. That is consistent with one tenant being involved, and the only tenant anyone has named publicly is the staging one.

Then the phrase sensitive personal data. In UK and EU data protection law, which governs a firm headquartered in London and listed by Everest under Great Britain, that phrase is commonly read as the special categories of personal data in Article 9 of the GDPR, and it was the statutory term under the UK Data Protection Act 1998: among them health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, and sex life or sexual orientation. Names, work and personal email addresses, phone numbers, home addresses and employment histories are personal data. They are not sensitive personal data in that sense. Everest's description of the personal data lists exactly those ordinary categories. So PwC's sentence can be entirely accurate and still be fully consistent with Everest holding the home addresses and career histories of a very large number of PwC people.

Then client data. A learning platform records who completed which course. At a professional-services firm, some courses are engagement-specific: independence training for a named audit client, onboarding for a client's systems, tool certifications required before a team member touches a client environment. Whether any of that counts as client data depends on a definition PwC has not shared. Hackmanac's description of the archive also includes internal audit methods and confidential documents, which, if accurate, sits closer to that line. It is a fair question, not an accusation.

"Once we learned of this incident we acted promptly to secure the environment and conduct a thorough review."

This sentence contains no date. It does not say when PwC learned of the incident, whether that was before or after Everest's post, when the environment was secured, or by whom. Secure the environment is normal customer work on a hosted platform: the customer controls its own single sign-on, administrator accounts and integration credentials. What the sentence leaves out is which of those PwC had to secure, and whether the vendor had to secure anything on its side. So far the only party that has spoken is the customer.

"Does not impact our network or any of our operations."

That is a statement about blast radius, not about data. It echoes June 2023, when PwC told Cyber Daily that MOVEit was "a third-party transfer platform" and that "PwC uses the software with a limited number of client engagements," and Cyber Daily reported that PwC's own systems remained secure. A month later Clop posted PwC data on both dark-web and clear-web sites. The 2023 statement was not false. The reassurance about PwC's systems answered a different question from the one PwC's clients were asking, which was about their data.

What PwC's 2026 statement does not contain is the list a breach notice exists to provide: the vendor's name; when the intrusion began and ended; when PwC was told; whether data was actually exfiltrated or only exposed; how many current and former employees, contractors and candidates are in the records; which countries' regulators have been notified; and what affected people should do. PwC declined to answer two of those questions when Reuters asked. The others were not addressed.

What Everest says it has, and why to discount it

Everest's description, as relayed by Reuters, is "Regional HR and learning exports, integration documentation, software components and PwC e-learning courses," with personal data including names, email addresses, phone numbers, addresses and employment history. Hackmanac's alert puts the archive at 590.69 GB and 108,426 files and, according to Cybersecurity News, describes it as including employment and training records, internal audit methods, confidential documents, and single sign-on source code and configuration files, with regions including Australia, China, Canada and the United Kingdom and one HR dataset of 213,084 records. From the screenshot itself, Cybersecurity News counts 494 directories, 1,333 archive containers and 53 nested containers. It also reports an October 28 release date that it could not independently confirm. Reuters, which dated the post to October 22 using the eCrime.ch tracker, reported a countdown with five days remaining.

Every one of those figures comes from the extortionist. Everest has a documented habit of inflation. In February, it claimed 1.4 terabytes from Iron Mountain. Iron Mountain said that "no Iron Mountain systems have been breached" and that a single compromised login credential had been used to reach one folder, marketing materials shared with vendors on a public-facing file-sharing site. ZeroFox, in a February 6 flash report, judged it "unlikely" that Everest's Iron Mountain claims were credible and said the group has likely exaggerated or fabricated some victim data before. Cybernews, reviewing the Iron Mountain screenshots as reported by teiss, noted folder names that appeared to contain customer names. Both things can be true at once: the extortionist overstates, and the victim's first sentence understates.

That is the frame for PwC. Nobody outside PwC and its vendor knows whether 590 GB is real, whether 213,084 records means 213,084 people, or whether the staging directory held anything but test configuration. What is knowable today is that the directory name in Everest's screenshot matches a live staging tenant bearing PwC's name, and that PwC's own description of the site, employee learning records, matches what a Cornerstone tenant holds.

A staging tenant is supposed to be the boring one

Large customers of a platform like Cornerstone commonly run more than one copy of it. Production is where employees actually take training. Staging is where administrators test a new course catalogue, a new single sign-on configuration, a new HR data feed, before any of it touches production. Staging exists so that mistakes happen somewhere harmless.

It stays harmless only if it does not hold real data. That is where the practice often slips. To test a nightly HR feed, someone needs a file that looks like the nightly HR feed, and the fastest way to get one is to copy the real one. To test reporting, someone loads last quarter's completions. Once a staging tenant has been seeded with production exports, it holds production data under controls designed for test data: fewer reviewers, looser access, older integration credentials, less monitoring, and a lower priority on every security team's list.

Everest's description of what it holds begins with "regional HR and learning exports" and "integration documentation." Exports and integration documents are exactly what an administrator moves into a staging tenant to test a feed. Hackmanac's description adds single sign-on configuration files, which is what an administrator tests in staging before changing how people log in to production. If the archive came from the staging tenant, and if those exports are real, then the most important question in this incident is not whether Cornerstone was breached. It is why real employee records were in staging at all. We are stating that as a hypothesis. It is the one PwC can confirm or rule out fastest.

The fix has been written down for two decades

None of this is new. The control that addresses it has been published, in nearly identical words, by the standards bodies a Big Four firm audits against. ISO/IEC 27001:2005 already carried it as A.12.4.2, Protection of system test data.

NIST Special Publication 800-53, Revision 4, published in April 2013, included control enhancement SA-15(9), Use of Live Data. It requires that the organization "approves, documents, and controls the use of live data in development and test environments." Revision 5 carried the requirement forward as SA-3(2).

ISO/IEC 27001:2013 carried Annex A control A.14.3.1, Protection of test data: "Test data shall be selected carefully, protected and controlled." The 2022 revision renumbered it as control 8.33, Test information. Cornerstone holds ISO 27001 certification audited by LRQA, according to its trust center.

The payment card industry was blunter still. PCI DSS version 3.2.1, Requirement 6.4.3, states that production data, meaning live card numbers, is not used for testing or development.

The failure mode these controls describe has a famous recent example. In January 2024, Microsoft disclosed in an 8-K that a Russian state-sponsored actor, the group Microsoft tracks as Midnight Blizzard, had, beginning in late November 2023, "used a password spray attack to compromise a legacy non-production test tenant account," and used it to reach a very small percentage of corporate email accounts, including members of its senior leadership team. The phrase that mattered was non-production. The account was in a place everyone treated as unimportant, and it connected to everything important.

Deloitte supplied the version closer to this industry. Rhode Island's RIBridges benefits system, which Deloitte built and ran, was breached starting in July 2024 using stolen credentials belonging to a Deloitte representative, according to the CrowdStrike forensic report described by the Rhode Island Current. The attacker had access to 28 of the system's 338 backend environments for about five months, an estimated 644,401 people were potentially affected, and the Brain Cipher group leaked at least some of the stolen data. Deloitte paid the state $5 million in February 2025 and another $7 million in an April 2026 settlement, without admitting liability. Environments again: not the system, but the copies around it.

PwC has its own small precedent. In May 2020, a security researcher found that a forgotten PwC subdomain, amyca-devapi.pwc.com, had been taken over to serve adult-content spam, according to The Register and Going Concern. By its name, it was a development API host. It was the kind of thing nobody watches because it is not supposed to matter.

Whose incident is it?

PwC calls this a vendor incident. That label has been doing a lot of work in 2026, and it hides a distinction boards need to keep straight.

In one version, the vendor's platform was compromised. An attacker got into Cornerstone's infrastructure or its support tooling and reached into customer tenants. That is a supply-chain incident. Cornerstone, which said in 2021 that it served more than 6,000 customers and 75 million users, would owe notice to many of them, and the question would become how many other customers' staging tenants were reachable.

In the other version, the vendor's platform worked as designed and someone used a valid PwC-side credential: an administrator account, an API key for the HR integration, an SFTP account used to drop export files, a service account that never had multi-factor authentication. That is PwC's incident, hosted on a vendor's servers.

The 2024 Snowflake campaign is the template for the second version. Mandiant found that the group it tracks as UNC5537 had used customer Snowflake credentials stolen by infostealer malware, some dating back to 2020, and that the attacks succeeded largely because of "a lack of multi-factor authentication." As many as 165 customer organizations were potentially exposed, according to the reporting on Mandiant's findings. Snowflake's platform was not the weak point. Its customers' logins were.

Everest's own model makes the second version at least plausible. The group has operated as a hybrid of extortion crew and initial access broker since 2021, according to The Register. In October 2023 it posted an advertisement on its leak site, reported by The Register, offering corporate insiders a "good percentage" of the proceeds for access to organizations in the United States, Canada and Europe through tools including TeamViewer, AnyDesk and RDP. At Iron Mountain in February, the company said the way in was one compromised login credential.

We do not know which version this is. Neither, publicly, does anyone else, because the two parties who know have not said. The distinction is not academic. It decides who notifies whom, whose insurer pays, whose SOC 2 report has an exception in it next year, and whether thousands of other organizations should be checking their own Cornerstone staging tenants this weekend.

Everest, briefly

Everest is a Russian-language extortion operation that ZeroFox first observed in 2021 and has tracked across at least 286 extortion incidents since. Its victims skew to North America and to healthcare, technology, manufacturing and financial services. The ransomware.live tracker holds 421 Everest listings. The weeks before PwC show the shape of its current target list: CCA Bank in August; ETS, Reliance Audit and Securitas Group on September 25; the Dutch firm B-accountants on October 6; and, on October 21 and 22, Lanham Associates and the U.S. law firm Linebarger Goggan Blair & Sampson. PwC was posted less than ten hours after Linebarger.

The MITRE ATT&CK mapping is necessarily conditional, because no indicators have been published. If the archive was taken with a valid account, the technique is T1078.004, Valid Accounts: Cloud Accounts. If it came through the vendor, it is T1199, Trusted Relationship. The collection itself is T1213, Data from Information Repositories, and the extortion that follows is T1657, Financial Theft. None of those is observed. Each is a question for PwC's investigators.

PwC has been here before, and so has the Big Four

This is PwC's fourth appearance on a ransomware tracker in under three and a half years. Clop listed it twice during MOVEit in June and July 2023. Dispossessor listed pwc.com in 2024. Everest listed it on Thursday. Of the three earlier listings, only the 2023 incident was confirmed by PwC, and only in the narrow form quoted above.

The rest of the Big Four has had the same year. Cloudskope documented in July that EY's tax practice lost client documents through what EY would only call a third-party information technology service management platform, and that EY still had not named it. A Massachusetts filing posted this month shows EY providing notice on behalf of Gallatin Point Capital, a financial-services investment firm, for the same platform, still unnamed. On October 9, a group calling itself The Gentlemen was reported, by the HookPhish tracker, to have listed Deloitte on its leak site; that claim remains unverified, and we draw no conclusion from it. Deloitte's RIBridges settlement closed in April.

Two confirmed Big Four incidents in one year, both on a vendor's platform, both described by the firm in category nouns rather than names. EY said IT service management platform. PwC said third-party vendor used to host company employee learning records. In each case the most useful single fact for every other customer of that vendor, which vendor, is the one fact withheld.

The vendor's owners were already marking it down

Cornerstone OnDemand has been privately owned since October 2021, when Clearlake Capital Group took it private in a transaction valued at about $5.2 billion, or $57.50 a share. The buyout was financed in part with loans that now sit in the portfolios of the largest private-credit lenders in the United States, which file their holdings with the SEC every quarter.

Cloudskope searched EDGAR's full text for "Cornerstone OnDemand" in filings made since July 1. It appears in 68, among them 10-Qs from Ares Capital, Blue Owl Capital Corp, Blue Owl Technology Finance, Blue Owl Credit Income, the Blackstone Private Credit Fund, Golub Capital's private credit fund, New Mountain Finance and Onex Direct Lending.

The marks tell a story that predates Everest. Ares Capital reported a $137.5 million second-lien loan to Cornerstone OnDemand and its holding company at a fair value of $88.0 million on June 30, 2026, down from $125.1 million six months earlier. Its total Cornerstone position, loans plus preferred and common equity, carried a cost of $364.6 million and a fair value of $232.3 million. Ares recorded $106 million of net unrealized depreciation on Cornerstone in the first half of 2026, $43 million of it in the second quarter. Blue Owl Technology Finance marked its $71.7 million slice of the same second-lien loan at $41.2 million, from $64.5 million at year-end. A Cornerstone revolving loan in Ares's schedule matures this month.

We are not drawing a line from those marks to this incident. There is no evidence of one, and lenders cut software valuations for many reasons. The point is narrower. A Big Four firm's learning records, and, by Cornerstone's 2021 count, the training records of some 75 million users, sit on a platform whose lenders were valuing its junior debt at roughly 64 cents on the dollar in June. When a vendor's capital structure is under that kind of pressure, its customers should be asking what is happening to its security budget, its staffing and its willingness to say the word incident in public. Those are diligence questions, and they apply to every vendor in that condition, not only this one.

Why there may never be a U.S. breach letter

Readers who follow Cloudskope's coverage are used to the next step: the notice letter filed with a state attorney general, where the company finally has to write down a date range and a number. For this incident, in the United States, that letter may never exist.

U.S. state breach-notification statutes are triggered by defined categories of personal information. California's, at Civil Code section 1798.82, is typical: a name combined with a Social Security number, a driver's license or government ID number, a financial account number with its access code, medical or health-insurance information, biometric data, and a few others; or a username or email address combined with a password or security question. Most states follow the same pattern. A name, an email address, a phone number, a home address and an employment history, the data Everest describes, do not meet that definition in California or in most other states. If the archive is what Everest says and nothing more, PwC may owe no U.S. state regulator anything.

The United Kingdom is different. Under Article 33 of the UK GDPR, a controller must notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. A processor, which is what a hosted software vendor is, must tell the controller "without undue delay." Cornerstone's own trust center describes that split in its GDPR statement: "Our customers, as ultimate data controllers, also must do their part to ensure both employee and candidate data remains private and well-protected." PwC is the controller. The 72-hour clock is PwC's. PwC has not said whether it has notified the ICO or any other data protection authority in the regions Everest names.

The result is a disclosure regime that works backward. The more ordinary the data, the less anyone is required to say about it in the United States, and the more useful that same data is to the next attacker.

The data is ordinary. What it enables is not.

Here is the part of this incident that falls on PwC's clients rather than on PwC, and it is the part Cloudskope's readers should weigh.

A learning platform at a professional-services firm is, functionally, a staff directory with context. It records who works where, in which service line, at what grade, since when, and what they were trained to do. Combined with a home address and a personal phone number, that is the raw material for impersonation. An attacker who knows that a named senior associate joined a firm's financial-services assurance practice in a particular city two years ago, and completed the training required for a specific audit tool, can write an email to that associate's client that is very hard to tell from the real thing. Or a phone call to that associate, at home, pretending to be the firm's IT help desk.

That is not hypothetical as a technique. It is the core method of the groups that have defined 2026 for Cloudskope's readers: help-desk vishing, credential reissue, and requests that arrive from a trusted outside party at exactly the moment the client expects one. Audit season, quarter-end confirmations and deal diligence all produce a steady flow of legitimate requests from Big Four staff for documents, data-room access and sometimes bank details. Banks, credit unions, insurers, portfolio companies and the general counsel's office are on the receiving end. We are stating this as an inference about risk, not a report of any observed fraud. No one has reported misuse of this data.

This is materiality asymmetry in its plainest form. To a firm with $60.2 billion in revenue, the theft of employee learning records is, very likely and very reasonably, immaterial. To a regional bank whose audit team's names, roles and contact details are now in an extortion archive, it is a live fraud vector heading into year-end. PwC's sentence was written for the first audience. The risk sits with the second.

What PwC should have done by now

PwC is the firm that, through its Digital Trust Insights research, has spent years telling boards that third-party risk is their blind spot. The standard to hold it to is its own.

1. Name the vendor. Every other organization using the same platform needs one word to begin checking its own exposure. Whatever the reason, withholding it chiefly protects the vendor.
2. Say which environment. Production, staging, pilot or sandbox. If it was staging, say whether real employee data was in it and why. That answers the most important control question in the incident.
3. Say whose door it was. A compromise of the vendor's platform and the use of a PwC-side credential on a vendor-hosted tenant are different incidents. PwC is best placed to know which this is.
4. Give the dates. When access began, when it ended, when PwC learned of it, and whether that was before or after Everest's October 22 post.
5. Give the count, and the populations. Current staff, former staff, contractors, candidates, and in which countries. A firm of more than 360,000 people that has employed far more over the years owes them that much.
6. Tell the people in the records what to watch for. One paragraph on impersonation, help-desk calls and requests for credentials or MFA resets would cost nothing. So would a note to clients that PwC staff details may be in circulation and that out-of-band verification applies.
7. Confirm the regulators. Whether the ICO and the other relevant data protection authorities were notified, and when.

Seven items. None requires new technology. None has been done in public.

What boards should be asking this week

For boards, audit committees and general counsel of organizations that PwC audits or advises:

First, has PwC told us anything, and do we know whether any member of our engagement team is in the affected records? If the answer is no, ask. The engagement partner can find out.

Second, are our finance, treasury and accounts-payable teams on notice that requests appearing to come from our auditors or advisers need out-of-band verification for the rest of the audit cycle? Callback to a number already on file, not one in the email.

Third, does our help desk know that a caller claiming to be an outside auditor, with accurate personal details, is not thereby verified?

For every board, about its own vendors:

Fourth, which of our SaaS vendors run staging, pilot or sandbox tenants for us, and what is in them? Ask the HR, learning, payroll and CRM owners for a written answer. The answer is often that nobody knows.

Fifth, which integration accounts feed those tenants, are they behind multi-factor authentication or certificate-based authentication, and when were their keys last rotated?

Sixth, when a vendor suffers an incident, who is the controller, who owns the 72-hour clock in the UK and the EU, and has that allocation ever been tested?

For sponsors and acquirers

Non-production environments belong in cyber due diligence, and they are almost never in it. A target can present a clean SOC 2 report for its production platform, an ISO 27001 certificate and a tidy vulnerability program, while a staging tenant seeded with last year's HR export sits outside all three. Ask for an inventory of every non-production tenant the target holds at its five most important SaaS vendors, what data each contains, and who can reach it. Ask whether the target follows its own test-data policy, if it has one.

The vendor side matters too. Cornerstone is one of many sponsor-owned software companies whose debt is held by private-credit funds and marked quarterly in public filings. Those marks are an early, free signal of vendor stress. A portfolio company whose critical vendor's second-lien debt has fallen from about 91 to about 64 cents on the dollar in six months should be asking that vendor about security staffing and incident-disclosure commitments now, before renewal, not after an extortion post.

For deal teams with a live process in which PwC is an adviser: there is no reason, on what is public, to believe client deal data was involved, and PwC says it was not. There is good reason to tighten verification on any request that changes data-room access, payment instructions or credentials in the weeks ahead.

What we are not saying

We are not saying Cornerstone OnDemand was breached. PwC has not named its vendor and Cornerstone has issued no public statement we could find. We are saying that the directory name Everest displayed is a Cornerstone hostname bearing PwC's name, and that the tenant is live.

We are not saying PwC put real employee data in a staging environment. We are saying that is the question the evidence raises, and that PwC can answer it.

We are not saying Everest's figures are accurate. The group has overstated before, and every number attributed to it here is its claim.

We are not saying any client data was taken. PwC says the site held none.

We are not saying the private-credit marks on Cornerstone's debt caused or contributed to this incident. We are saying they are a public signal that diligence teams can read.

We are not saying the other Big Four firms named in this piece are connected to this incident. They are not, on any evidence we have seen. The other firm whose staging hostname resolves on csod.com is mentioned only to show that such tenants are standard.

If PwC, Cornerstone or Clearlake would like to correct any of this, this page will be updated the same day.

Our record of these incidents

• PwC vendor-hosted learning records claimed by Everest, the verified timeline and running list of unknowns
• Three Breaches, Three Years. EY Still Won't Name the Platform That Failed.
• 402,760 People. Nine Banks and Credit Unions. When the auditor is the side door
• One Stolen Key. 300+ Companies' Email. ConnectWise 'Cannot Determine' Whose.
• Elsevier Was the Name on the Page. RELX Was the Pattern.
• Instructure's Own Documents Don't Add Up
• What Is Third-Party Risk Management (TPRM)?

Sources

• AJ Vicens, Reuters, PwC confirms cybersecurity incident involving employee learning records, October 23, 2026 (also at Global Banking & Finance Review)
• Cybersecurity News, PwC Data Breach Claim: Everest Ransomware Group Claims to Have Stolen 590 GB of Data, October 23, 2026
• Hackmanac, Cyber Alert: PwC, October 22, 2026
• CyPro, Everest PwC Claim Remains Unverified, October 22, 2026
• Tom Vance, shattered.io, PwC Vendor Breach: Everest Claims 590 GB, October 23, 2026
• ransomware.live, Victim: PWC (Everest), discovered October 22, 2026
• PwC, PwC announces FY26 global financial performance, October 19, 2026
• Cornerstone OnDemand, Trust Center, captured October 24, 2026
• Business Wire, Cornerstone OnDemand Enters Definitive Agreement to Be Acquired by Clearlake Capital Group in $5.2 Billion Transaction, August 5, 2021
• Ares Capital Corporation, Form 10-Q for the quarter ended June 30, 2026
• Blue Owl Technology Finance Corp., Form 10-Q for the quarter ended June 30, 2026
• ZeroFox Intelligence, Flash Report: Everest Continues to Tout Prominent Brands in Latest Disclosures, February 6, 2026
• teiss, Iron Mountain confirms data security incident following Everest ransomware claims, February 5, 2026
• Connor Jones, The Register, report on Everest's offer to corporate insiders, October 12, 2023
• Cyber Daily, PwC swept up in MOVEit hack, June 19, 2023
• Cyber Daily, PwC has data leaked on the clear web, July 20, 2023
• Microsoft Corporation, Form 8-K, Exhibit 99.1, January 2024
• Alexander Castro, Rhode Island Current, State announces $7 million settlement with contractor Deloitte over RIBridges cyber breach, April 24, 2026
• Adrienne Gonzalez, Going Concern, Cybersecurity Experts PwC Get One of Their Subdomains Hijacked By Porn Spam, May 8, 2020 (citing The Register's report of May 6, 2020)
• Ravie Lakshmanan, The Hacker News, Snowflake Breach Exposes 165 Customers, June 11, 2024
• HookPhish, Deloitte Data Breach: The Gentlemen Ransomware Claim, October 10, 2026
• National Institute of Standards and Technology, SP 800-53 Rev. 4, SA-15(9) Use of Live Data, April 2013
• ISO/IEC 27001:2013, Annex A.14.3.1 Protection of test data
• PCI Security Standards Council, PCI DSS v3.2.1, Requirement 6.4.3
• PwC, Third-party cyber risks are a glaring blind spot according to PwC survey, 2021 (Global Digital Trust Insights 2022)
• Information Commissioner's Office, Personal data breaches