PwC confirms an incident at a training records provider
PwC reports an incident at an external provider hosting training records. The case shows why third-party reviews should also include internal human resources tools.
News summary
On 23 October, Reuters reported that PwC was aware of a cybersecurity incident at an external provider hosting employee training records. A PwC spokesperson said the affected site contained no client data, sensitive personal data or financial information, and that the incident did not affect its network or operations. These are company statements, not independent forensic conclusions.
The Everest group claimed to have obtained 590 GB, but PwC did not confirm the volume or the accuracy of those claims. That quantity should not be presented as verified theft. The report does not establish any Spanish victims either. For professional practices and service businesses, however, it provides a reason to review training platforms, human resources platforms and other less visible providers.
Source: Reuters / Euronext — 23 October 2026
What to review in your business
Inventory the employee information each provider receives and how long it retains it. Limit permissions and shared data to what is necessary for the service.
If a third party reports an exposure, request details of its scope and supporting evidence, and coordinate the assessment with the person responsible for data protection. Applicable obligations depend on the actual impact, not on an attacker's statement.
Concepts mentioned in this article: Cybersecurity
At Seintec, we help you review affected systems and prioritise protective measures based on your environment. Contact our team.
Contact SeintecRelated service
Cybersecurity
We shield your business so it never stops.