FBI drops an Accenture contractor after a missed patch exposed staff data

The bureau pinned the breach on a single missed fix.

A senior FBI official told Reuters that an unnamed contractor hadn't applied a security patch to a system in its care.

"As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce," the official said.

The FBI didn't name the company or the platform, and The Next Web said it hadn't independently verified the report.

Not much.

Accenture told Reuters it was proud to support the FBI and would continue to do so. It didn't respond to questions about the contractor or the missed patch, according to The Next Web.

Last month, the extortion group ShinyHunters said it had used a PeopleSoft flaw to break into the FBI's jobs portal.

What it claimed: the group said it held data on almost all FBI agents and on people who had applied to work for the bureau, The Next Web reports. ShinyHunters told The Register it had used an unspecified, unconfirmed Oracle PeopleSoft zero-day to breach the portals, according to Help Net Security.

How far it says it got: the group also claimed it breached FBI-managed servers on AWS GovCloud and stole personnel files on current, former and aspiring FBI employees.

Which systems: according to the BBC, the group claimed access to FBIJobs, FBI BEAST, which handles background checks on employees and applicants, FBI MedLink, which stores medical records, and FBI BICS, which contains investigative information, Help Net Security reports.

How much: ShinyHunters claimed in posts on the dark web and messages to media outlets that it stole 2 to 3 terabytes of data related to FBI workers, CBS News reports. Its claim to have data on every FBI employee hasn't been publicly verified.

Sensitive roles: among the stolen documents is one that "provides data on roles of FBI staff in little-known or sensitive FBI units," Reuters reported, according to Help Net Security. Reuters couldn't verify that all the job assignments were authentic or up to date. But it matched the career details or titles of eight people in the leaked data to court filings, news articles, LinkedIn profiles or posts on sites such as Instagram.

When it surfaced: the breach was first reported on September 22 by 404 Media, according to CBS News. The FBI confirmed it was investigating ShinyHunters' claim about employee data the same week, Help Net Security reported.

It says it wasn't about money.

ShinyHunters described the attack as revenge, The Next Web reports. It targeted the FBI over a May advisory about the group's methods, and demanded the bureau correct the advisory instead of paying a ransom.

That advisory had told victim organizations not to pay ShinyHunters, Help Net Security notes. The group threatened to release the stolen information if the FBI didn't retract what it called "false allegations."

The FBI's online portals for job applicants and special agent applicants were still offline as of late September, Help Net Security reported.

The exact route into the FBI hasn't been confirmed. But security researchers have documented how ShinyHunters attacks PeopleSoft.

The original flaw: in May and June, ShinyHunters exploited a PeopleSoft vulnerability, CVE-2026-35273, as a zero-day, mostly against academic institutions, according to Google Cloud's Mandiant, as reported by Help Net Security.

Oracle's advice then: apply the emergency patch, or if that wasn't possible, restrict network access to PeopleSoft servers to trusted internal networks.

The warning: "Relying solely on Web Application Firewall (WAF) body-inspection rules is insufficient, as these controls can be bypassed," Mandiant said at the time.

The bypass: Mandiant now says ShinyHunters modified its exploit to get around firewall rules blocking the vulnerable endpoint. "The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path," Mandiant's analysts wrote. That let the group reach the endpoint on systems whose operators believed their firewall rules had mitigated the problem.

"The current campaign demonstrates that [ShinyHunters] adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability," Mandiant said.

The group has since expanded its targets to higher education, technology, IT services, healthcare, agriculture, transportation and government, according to Mandiant.

After getting in: once inside, the group deploys web shells and a legitimate remote management tool called MeshAgent, and runs commands without writing files to disk, Help Net Security reports, citing Mandiant. Using legitimate tools and fileless commands can make an intrusion harder to spot.

Not confirmed for the FBI: neither the FBI nor Reuters has said whether this same flaw was used against the bureau, The Next Web notes.

The FBI says yes, more than one person.

"The Bureau continues to aggressively investigate the recent Cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects and we will spare no resource in bringing each of the responsible individuals to justice," the FBI said, according to CBS News.

A suspected member of the group was detained in Jordan and is cooperating with investigators, CBS News reports, citing US officials. Separately, Dutch police arrested a 24-year-old man in Amsterdam on September 15 on suspicion of being a member, days before the FBI breach was announced.

ShinyHunters told Reuters that the Amsterdam suspect had "no association" with the group, according to CBS News. It's unclear how many other alleged hackers may be involved, a US source told CBS News, and the FBI is still determining how far the damage from the breach goes, The Next Web reports.

Some former FBI officials have described the breach as a major blow to the bureau's operational security, according to Reuters.

The FBI's own explanation is that the weak point wasn't the bureau's network, but a patch that an outside contractor didn't install. Big organizations hand large parts of their IT to firms like Accenture, so a single missed update at a vendor can expose an agency's most sensitive people.

• If you run PeopleSoft: install Oracle's patch. Mandiant's research shows firewall rules alone didn't stop this group.
• If you rely on IT contractors: check who is responsible for patching each system, and verify it's actually done.
• If you applied to the FBI or work there: watch for official notices from the bureau, and be wary of phishing that uses your personal details.