# FBI removes contractor after a missed patch led to the ShinyHunters breach of employee data

Source: https://startwithidentity.com/blog/2026-10-06-fbi-removes-accenture-contractor-after-missed-patch-led-to-shinyhunters-breach/
Last updated: 2026-10-06
License: content by Start with Identity. Cite the source URL.

---

The FBI has removed a contractor it holds responsible for the September breach that exposed personal details of thousands of bureau employees, according to Reuters and The Hacker News. Brett Leatherman, assistant director of the FBI Cyber Division, said the incident came from a security failure on a platform managed by a third-party organization, after a contractor failed to apply a patch issued specifically to secure it. The FBI named neither company. Reuters, citing sources, identified the platform as [Oracle](https://startwithidentity.com/vendors/iam/oracle/) PeopleSoft and the contractor's employer as Accenture, which said it was proud to support the FBI and did not discuss the individual. ShinyHunters had claimed it breached the FBI's jobs portal through PeopleSoft. Mandiant has separately tied the group to exploitation of PeopleSoft flaw CVE-2026-35273, though the FBI has not said which flaw was used here.

## Why it matters

PeopleSoft is a human resources system, which makes it the authoritative source of workforce identity data, and its contents are exactly what an attacker needs to impersonate staff to a help desk or target them by phone. The control that failed was not authentication but patch ownership: the FBI outsourced operation of the platform, and the review found the patch was never applied. Outsourcing the work does not outsource the risk.

Two checks follow. First, list every system that holds employee identity records (HR, payroll, recruiting portals) and confirm who applies patches, under what deadline, and how you verify it happened rather than taking the contract on trust. Second, if your staff records leak, expect [help-desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/) and [vishing](https://startwithidentity.com/glossary/vishing/) to follow, and tighten identity verification for resets before that happens. For background on the group, see our coverage of the [Dutch arrest in the ShinyHunters investigation](https://startwithidentity.com/blog/2026-09-28-dutch-police-arrest-suspect-in-shinyhunters-investigation/), which covers the same PeopleSoft WAF-bypass exploitation.

Source: [The Hacker News](https://thehackernews.com/2026/10/fbi-removes-accenture-contractor-after.html)