FBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.
The FBI has removed a contractor it holds responsible for the September breach that exposed personal details of thousands of bureau employees, according to Reuters and The Hacker News. Brett Leatherman, assistant director of the FBI Cyber Division, said the incident came from a security failure on a platform managed by a third-party organization, after a contractor failed to apply a patch issued specifically to secure it. The FBI named neither company. Reuters, citing sources, identified the platform as Oracle PeopleSoft and the contractor's employer as Accenture, which said it was proud to support the FBI and did not discuss the individual. ShinyHunters had claimed it breached the FBI's jobs portal through PeopleSoft. Mandiant has separately tied the group to exploitation of PeopleSoft flaw CVE-2026-35273, though the FBI has not said which flaw was used here.
Why it matters
PeopleSoft is a human resources system, which makes it the authoritative source of workforce identity data, and its contents are exactly what an attacker needs to impersonate staff to a help desk or target them by phone. The control that failed was not authentication but patch ownership: the FBI outsourced operation of the platform, and the review found the patch was never applied. Outsourcing the work does not outsource the risk.
Two checks follow. First, list every system that holds employee identity records (HR, payroll, recruiting portals) and confirm who applies patches, under what deadline, and how you verify it happened rather than taking the contract on trust. Second, if your staff records leak, expect help-desk social engineering and vishing to follow, and tighten identity verification for resets before that happens. For background on the group, see our coverage of the Dutch arrest in the ShinyHunters investigation, which covers the same PeopleSoft WAF-bypass exploitation.
Source: The Hacker News
Related on Start with Identity
- BlogASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third
- BlogShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials
The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- BreachOkta's 2023 support-system breach: when your IdP gets phished
How attackers used a stolen credential to read Okta support cases and harvest session tokens, why HAR files were the weak link, and what it taught the industry