← Zur Übersicht
Gruppe
Everest
Erfassungsdatum
Status
Online / unverändert

Hinweise zur Einordnung

Dieser Eintrag dokumentiert eine Veröffentlichung der Gruppe. Ein Angriff oder Datenabfluss ist damit nicht unabhängig bestätigt.

  • Land: nicht verfügbar
  • Branche: nicht verfügbar

Konfidenz ist eine heuristische Einschätzung. Prüfzeitpunkte beziehen sich auf die Anreicherung, nicht auf unabhängige Verifikation. Herkunft und Korrekturen finden Sie unter „Firmeninformationen & Datenherkunft“.

Firmeninformationen & Datenherkunft

Angaben der Ransomware-Gruppe

Unbestätigt

Quellentext als öffentliche Metadaten wiedergegeben. Die Aussagen wurden nicht unabhängig geprüft; Links sind ausgeblendet.

[Link entfernt] 590 GB DataBase

The materials include regional HR and learning exports, integration documentation, software components and PwC e-learning courses.

01. MAIN FINDINGS

The [Link entfernt] directory contains internal PwC corporate learning data, Cornerstone OnDemand platform materials, regional HR and learning exchanges, e-learning courses, and integration testing and maintenance documents. The dataset totals 590.69 GB and comprises 108 426 files in 494 directories. The archives comprise 1 333 original containers and 53 nested containers: 1 386 containers in total, with 19 324 files inside them.

The HR materials contain information about individuals and their organisational and employment history. The HR exports include names, email addresses, telephone numbers, address fields, offices, cost centres, job titles, managers, coaches, hire and departure dates, employment statuses, reasons for absence, professional attributes, learning history, course results, training exemptions, reasons for withdrawing from sessions, and external training information.

Large datasets include 10 835 893 Australia Transcript rows, 4 166 645 China/Hong Kong Transcript rows, Canadian sets ranging from 3 254 671 to 3 471 225 records, TASC Live Student with 1 217 946 rows, User with 213 084 rows, and Instructor with 318 933 rows. These figures relate to separate sources: the same users recur across versions, regions and daily snapshots.

Other large datasets include UK Student with 91 102 records and 162 fields, UK Transcript with 1 135 492 records, Argentina Transcript Report V2 with 774 687 records, Singapore Curriculum with 917 968 rows, and a Swedish series with 5 002 776 rows relating to 311 User ID values. The number of learning records and the number of User ID values are different measures.

The development materials extend beyond documentation. A Vantage diagnostic trace preserves the learning portal's browser JavaScript bundle and HTML templates for the user portal. SSO\[Link entfernt] contains solution and project files, four C# source files, and a separate Java implementation of single sign-on. Learning packages contain JavaScript extensions, progress logic, VBA, SCORM/AICC resources and embedded learning content. The software components provide the client interface, sign-on integration and e-learning applications.

The internal documentation describes the data exchange architecture in detail. Vantage Master Data Feed loads learning object attributes; Availability IDF controls availability; ESS/iAttend exchanges attendance information; ExSS links the LMS to an examination system; COMPLY connects professional engagement attributes with learning; and regional ODF specifications describe exports of users, catalogues, sessions, learning history and additional fields.

Three specifications carry an explicit CONFIDENTIAL marking in their main text: PWC ESS - ODF Specifications v28, PWC NGL ODF Specificationv30, and PWC NGL ODF Specificationv31. The SSO package and technical exports contain access and encryption parameters and codes used for sign-on and data exchange with the learning platform.

A separate group of materials records data quality issues and the history of changes. Canadian CT-51099 documents the cause of an error: an incorrect join retrieved Session data for Event and produced an incorrect completion date. Master Data Load QA preserves loading errors and exceptions, while one Luxembourg Transcript ends within a field and contains 24 808 fewer complete records than the stated count.

The data fields contain dates in 2025-2026. The User export contains more than 11 000 hire dates in 2026; Netherlands Catalog and Sessions contain creation and modification dates in 2026; UK CTS contains dates in October 2025; and PE-Analytics contains events in August 2025. Many newer files are snapshots of older history, while a separate large Polaris batch explicitly contains This is a test in every row.

Long learning export series are located in Denmark, Luxembourg and Singapore. The main Luxembourg series contains 116 731 235 stored rows relating to 4 248 User ID values; Singapore General Information contains 144 708 482 rows relating to 7 906 User ID values. Denmark Flow 5 contains 430 508 000 rows relating to 411 622 distinct User ID values across the entire series. These measures describe repeated snapshots and identifiers; they do not provide a single headcount for the entire directory.

Additional exports include 515 CSV files with data rows from 26 series, as well as CTS. Other learning materials include 58 MP4 files representing 28 distinct versions of video content, GALE supporting materials, and data from an external workbook cached in Issues_Tracker.xlsx. A separate group contains 6 863 encrypted OpenPGP exchange files.

Issues_Tracker.xlsx preserves a budget workbook cache with 39 938 non-empty cells. It includes reference lists of clients, engagements, employees and resources, territorial teams, and services. They contain US territories and 27 US service codes. These lists are independent: a row number does not establish a relationship between a client, an engagement and an individual. A PwC Canada course also contains an Engagement Planning Worksheet screenshot with five engagement rows and corporate contacts.

Sources:

D:\[Link entfernt]\_: regional HR and learning exports, integration documentation, software packages and course materials described in the following sections.

02. DATA CONTEXT

The [Link entfernt] materials relate to internal corporate learning infrastructure and data exchanges around Cornerstone. They cover users, course catalogues, learning history, sessions, instructors, availability, professional attributes, digital badges and regional integrations. The folder is not a single PwC client database and does not represent one software product.

Regional datasets have different schemas and rules. Canada retains its own CA fields; the Netherlands includes Client Code, Job Code, ESS Pin Codes and cost parameters; Mexico includes CURP/RFC and local professional attributes; China/Hong Kong includes Chinese names and regional fields; and Denmark and Singapore contain large learning and organisational attribute reports.

Sources:

D:\[Link entfernt]\_: Cornerstone learning platform datasets and regional integrations.

03. SIZE AND STRUCTURE

The main data comprises 108 426 files in 494 directories, with a total size of 590.69 GB.

The archives comprise 1 333 original containers and 53 nested containers: 1 386 containers in total, with 19 324 files inside them. Archive containers are included in the total size of the main data.

Most of the volume comes from repeated regional CSV/XLSX reports and large Transcript/Student files. The repository is varied: one directory may contain thousands of daily snapshots of the same selection, another a single Transcript several GB in size, and a third project documentation and small technical files.

Denmark accounts for most of the volume because of long report series with hundreds of thousands or a million rows per file. Singapore and Luxembourg also contain many repeated reports. Canada, CaSH-ChinaHK, UK, TASC and Reports contain large exports and versions of the same logical datasets.

Repeated snapshots

Daily exports preserve successive states of the same datasets. The main Luxembourg series includes 416 complete CSV files, while Parts Transcripts includes 413 CSV files. A separate main file ends within a record. The composition and sizes of the series are given in section 22. Repeated snapshots contain much of the same learning history.

Sources:

D:\[Link entfernt]\_: file and directory composition, stored archive containers and regional report series.

04. FILE COMPOSITION

The main data contains 108 426 files in the following formats. Nested materials form part of their respective archives.

Format Files Size

CSV 34 035 533.89 GB

XLSX 1 172 28.83 GB

TXT 59 090 22.23 GB

ZIP 1 332 5.38 GB

GPG 32 197.19 MB

LOG 541 68.25 MB

SAZ 1 41.62 MB

XLS 12 21.30 MB

DOCX 53 17.01 MB

XML 5 147 14.71 MB

7Z 1 6.27 MB

PGP 6 831 4.77 MB

PNG 164 3.86 MB

PPTX 3 0.58 MB

MSG 1 0.49 MB

JPG 3 0.15 MB

DB 2 0.03 MB

PDF 1 0.01 MB

OTHER 5 Stage\pwc_C#.zip and Stage\pwc_Java.zip: single sign-on source files and configuration.

D:\[Link entfernt]\_\Vantage\MDF Documentation\Australia perf issues - form and logs - [Link entfernt] > [Link entfernt]: browser JavaScript and HTML responses.

D:\[Link entfernt]\_\Offline Player Content: e-learning publications, course JavaScript and VBA.

D:\[Link entfernt]\_\LMS: published learning applications.

D:\[Link entfernt]\_\PL CLP and D:\[Link entfernt]\_\PWCEXE: regional sign-on page and language materials.

07. VANTAGE, SSO AND MASTER DATA FEED

Vantage browser application

The HTTP response contains js/[Link entfernt] with 171 050 characters. The homepage, site-navigation, recommended, dashboard and other templates show search, recommendations, mandatory learning with deadlines, "Done and doing", learning history, playlists and a calendar. The supporting [Link entfernt] implements a carousel and swipe gestures, while an adapted daterangepicker uses UTC date boundaries. Repeated SAZ files contain the same seven main HTML templates and the same interface version, 16.2.2.21, making them repeated diagnostic snapshots of one client bundle.

Vantage Master Data Feed

Master Data Feed loads standard and custom learning object fields: description, duration, provider, training level, target audience, line of service, subject and regional values. The rules require language to be taken into account, populated values not to be erased by empty optional fields, and repeated rows for the same LOID to be processed together. The specification provides for four runs per day over SFTP.

Availability IDF

Availability IDF defines which groups and organisational units can access a learning object, together with registration and approval parameters. Delete and Load applies to objects listed in the inbound file: the previous set of availability rules is replaced by the current set of rows for that object.

SSO

C# and Java implement security token generation and the sign-on form. [Link entfernt] contains a User ID placeholder, [Link entfernt] constructs and encrypts the message, and [Link entfernt] converts data. The C# assembly identifies Cornerstone OnDemand, Inc. as the company.

Configuration and reference tables

AU script [Link entfernt] contains 2 164 rows, 1 821 LOID values and 22 fields. Active = No appears in 1 690 rows and Active = Yes in 474; Training Title is populated in 238 rows, Description in 234, and Email Tag, Custom Field Type and Custom Field Value in 474 each. Repeated LOID values connect states and additional parameters of the same learning objects. Central\Analytics_BR.xlsx contains 2 862 PWC records and 1 914 PWCWest records with interface labels and language settings: column_id, name_display and culture_id.

Vantage fixes and language variants

Issues_23-[Link entfernt] and PWC Vantage Issues_ [Link entfernt] record issues involving the training request form, the record change indicator and Direct Reports, together with examples of fixes. CR - [Link entfernt] and MDF Lang [Link entfernt] show the handling of language variants in fields; Subjects - [Link entfernt] relates inbound subject identifiers, the update log and interface labels. These materials supplement the specifications with actual QA examples.

Dates of the preserved browser bundle

The response containing the Vantage client bundle was saved on 12 December 2017; HTTP Last-Modified is 7 December 2017. The template version is 16.2.2.21. Vantage execution logs relate to 2026 and reflect data exchange operations, while the browser bundle was preserved in 2017.

Sources:

D:\[Link entfernt]\_\Vantage\MDF Documentation\Australia perf issues - form and logs - [Link entfernt] > [Link entfernt] > raw\075_s.txt: Vantage browser application.

D:\[Link entfernt]\_\Vantage\MDF Documentation\CSOD - PwC Vantage Master Data Feed - Design Doc_v8.[Link entfernt]: Vantage Master Data Feed.

D:\[Link entfernt]\_\Vantage\Availability_IDF\Docs for Availability IDF\CSOD - PwC Vantage Inbound Data Feed - Design Doc_v0.[Link entfernt]: Availability IDF.

D:\[Link entfernt]\_\SSO\[Link entfernt] > Stage\pwc_C#.zip / Stage\pwc_Java.zip: SSO.

D:\[Link entfernt]\_\MDF\AU script [Link entfernt]: learning object attributes and additional field records.

D:\[Link entfernt]\_\Central\Analytics_BR.xlsx: interface labels and language settings.

D:\[Link entfernt]\_\Vantage\issues\Issues_23-[Link entfernt] and D:\[Link entfernt]\_\Vantage\issues\PWC Vantage Issues_ [Link entfernt]: interface defects and recorded fixes.

D:\[Link entfernt]\_\Vantage\MDF Documentation\CR - [Link entfernt], MDF Lang [Link entfernt] and Subjects - [Link entfernt]: language variants, subject identifiers and interface labels.

08. REGIONAL INTEGRATIONS

COMPLY - China/Hong Kong

The COMPLY integration sends attributes indicating an employee's participation in specific engagement types to the CSOD profile and receives learning history in return. It uses PCAOB, AICPA, US GAAP, IFRS and PCAOB QRP attributes. A separate combined CN US Engagement indicator is derived from these values.

ESS and iAttend

ESS China/Hong Kong connects session registration to electronic attendance tracking. CSOD sends session participants and session parts, after which attendance is returned to the LMS. Attendance Integration rules set Score = 0 and Pass/Fail = Pass for attendance recording; these are exchange control values, not an examination score. Archived PwCEast_chinahk_UserRegister_27092022080002.txt contains 7 057 records relating to 1 342 Staff ID values, with events, session parts, dates and locations. PWC ESS - ODF Specifications v28 extends the exchange to users, organisational data, sessions, learning history, instructors and groups; the document is explicitly marked CONFIDENTIAL.

ExSS

ExSS includes learning event creation, registration of eligible employees, and the return of status, Score and Pass/Fail. The document expressly states that the event creation interface is not intended to update an existing object, so repeated input may create a duplicate.

NGL and US exchanges

NGL (Next Generation Learning) covers the catalogue, learning history, groups, subjects, providers and organisational reference data; it describes a full initial transfe

Screenshot der Detailseite
Screenshot der Detailseite