INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

PwC confirms learning records breached in attack on vendor site

| 2026-10-26 14:04 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
PwC has confirmed a breach of its third-party vendor site, which houses employee learning records, amid claims from Everest ransomware that 590 gigabytes of data were stolen in an attack. The incident occurred on October 26, 2026, and is believed to be the work of Halcyon, an initial access broker group that has operated since late 2020. Since emerging, Halcyon has targeted critical-infrastructure providers globally, including Collins Aerospace in 2025. Everest ransomware recently claimed attacks against multiple international airports. The breach did not impact PwC's network or operations, and the company acted promptly to secure its environment after learning of the incident. A total of 364,000 workers worldwide are affected by this attack.
Technical Mitigations AI-generated
• Patch the Everest ransomware vulnerability in PwC's systems to prevent similar breaches. • Monitor for suspicious activity related to Collins Aerospace and Halcyon research on initial access brokers. • Implement a robust review process to detect insider threats, such as cash payments or profit sharing offered by attackers.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎late 2020
Threat actors using Halcyon as an initial access broker, have been providing credentials to other groups since late 2020.
organisation Halcyon
Since emerging in late 2020, the group has operated as an initial access broker and provided credentials to other groups, according to research provided by Halcyon.
‎2026/10/26
590 gigabytes of employee data were stolen in an attack on PwC's vendor site.
data_breach 590 gigabytes
The company disclosed the breach amid claims from Everest ransomware that it had stolen 590 gigabytes of employee data in an attack.
organisation Collins Aerospace
The group claimed attacks against multiple international airports in 2025, through an attack targeting Collins Aerospace .
victims 364,000 workers
PwC, based in London, is one of the world’s largest professional services firms , and has more than 364,000 workers worldwide.
Tactical Metrics
Metrics
data_breach
590
Gigabytes
The company disclosed the breach amid claims from Everest ransomware that it had stolen 590 gigabytes of employee data in an attack.
Metrics
victims
364,000
Workers
PwC, based in London, is one of the world’s largest professional services firms , and has more than 364,000 workers worldwide.
Intelligence Sources
Cybersecurity Dive 2026-10-26