# Everest Ransomware Group Claims 590 GB PwC Data Theft (Unverified)

> The Everest ransomware group claims to have stolen 590.69 GB (108,426 files) from PwC, including HR records, training content, internal audit methods and single sign-on source code and configuration files. The claim is unverified; no PwC response was identified and data authenticity, ownership and access scope remain open questions.

- **Published:** 2026-10-23T05:25:54Z
- **Last reviewed:** 2026-10-23T05:25:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4223
- **ID:** TL-2026-4223
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** TRACKING
- **Actor:** Everest ransomware group
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-22 the threat tracker Hackmanac publicly flagged a new listing on the Everest ransomware group's leak site naming PwC as a victim. CTIWatch's victim tracker also documented the listing. Cyber Security News reported the claim on 2026-10-23. According to that reporting, Everest claims 590.69 GB across 108,426 files, organised in 494 directories, 1,333 original archive containers and 53 nested containers.

Claimed content includes human resources records (213,084 entries; the number of unique individuals is unknown), training files and e-learning courses, integration testing documents, internal audit methods, confidential documents, and 'single sign-on source code and configuration files'. The geographic scope referenced covers Australia, China, Canada and the UK. One directory is named pwc-stg.csod.com, which points to a staging tenant on the Cornerstone OnDemand (csod.com) learning-management platform. This suggests the material may originate from a third-party SaaS/LMS environment or an export of it rather than from PwC's core network. That is an inference, not a confirmed fact.

Caveats: the claim is single-sourced and unverified. No PwC response was identified. No ransom demand, encryption event, initial access vector, CVE or IOC specific to this incident has been published. An alleged deadline of 2026-10-28 is also unconfirmed. Severity is held at MEDIUM pending verification.

Background on the actor: Everest has operated since at least December 2020 and has evolved from data-theft extortion into ransomware operations and increasingly initial access brokerage (first observed November 2021). NCC Group assessed with medium confidence that Everest ransomware is related to BlackByte (C# variant). NCC's incident-response reporting documents TTPs including exploitation of external remote services, RDP lateral movement with compromised accounts, LSASS and NTDS.dit credential dumping, Cobalt Strike and Metasploit C2, remote-access tools (AnyDesk, Splashtop, Atera) for persistence, WinRAR archiving and double extortion. These are historical group TTPs and are NOT confirmed for the PwC claim. The IOCs listed are from that earlier NCC reporting and are not linked to this incident. Everest's leak site was defaced and taken offline in April 2025 by an unknown party, but the group has since resumed publishing victims.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1650 Acquire Access
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219 Remote Access Tools
- T1560 Archive Collected Data
- T1657 Financial Theft

## Sources

- [PwC Data Breach Claim - Everest Ransomware Group Claims to Have Stolen 590 GB of Data](https://cybersecuritynews.com/pwc-data-breach-claim/)
- [NCC Group - Climbing Mount Everest: Black Byte Bytes Back](https://www.nccgroup.com/research/climbing-mount-everest-black-byte-bytes-back/)
- [Searchlight Cyber - Everest Ransomware Group Increases Initial Access Broker Activity](https://www.slcyber.io/everest-ransomware-group-increases-initial-access-broker-activity/)
- [BleepingComputer - Everest ransomware's dark web leak site defaced, now offline](https://www.bleepingcomputer.com/news/security/everest-ransomwares-dark-web-leak-site-defaced-now-offline/)
- [TEISS - Everest ransomware gang's dark web leak site hacked and taken offline](https://www.teiss.co.uk/news/everest-ransomware-gangs-dark-web-leak-site-hacked-and-taken-offline-15608)
- [Breached.company - Everest threat actor profile](https://breached.company/threat-actors/everest/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4223