FBI Blames Contractor’s Missed Patch for ShinyHunters Breach

Summary

The FBI has removed an Accenture contractor following a data breach that exposed personal information of thousands of its employees. According to FBI cyber chief Brett Leatherman, the incident resulted from a third-party managed platform where a contractor failed to apply a critical security patch. The breach targeted Oracle's PeopleSoft platform, with the ShinyHunters cybercrime group claiming responsibility and leaking some data.

Full text

The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees, Reuters reported on Tuesday, citing two people familiar with the matter. The FBI has not publicly named the contractor or the organization involved. However, a senior bureau official told Reuters that its review so far points to a security patch that had not been applied by the contractor responsible for the affected system. “To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in a statement. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” Leatherman added. According to Reuters’ sources, the system in question is Oracle’s PeopleSoft human resources platform, and the outside organization is Accenture. ShinyHunters had previously claimed it exploited PeopleSoft to break into the FBI’s job site, and Google recently warned that the threat actor had been targeting vulnerable PeopleSoft instances to steal data. Advertisement. Scroll to continue reading. Accenture did not answer questions about the contractor or the alleged patching failure. Instead, the company said in a statement that it was “proud to support the mission of the FBI and will continue to do so.” The ShinyHunters cybercrime group announced on September 22 that it had hacked FBI systems. It targeted the agency’s jobs website and allegedly obtained information on all employees, including sensitive information, some of which it leaked to the media. The attack allegedly aimed to pressure the FBI to correct or remove a report the agency published in May to warn organizations about ShinyHunters attacks. The hackers claimed the report made false allegations. Shortly after ShinyHunters announced the breach, law enforcement said it had arrested an alleged leader of the group in the Netherlands on September 15. ShinyHunters seemed defiant and urged victims to continue negotiating, threatening to leak their data unless they paid up. The arrest of another alleged ShinyHunters leader, Saif al-Din Khader (aka Rey), came to light on October 3. Rey was reportedly arrested in Jordan and has been cooperating with authorities. At the time of writing, ShinyHunters’ website is still live, but a post urging organizations to pay up has been removed. The most recent victim post is dated September 22. Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: In Rare Move, Alleged Iranian State Hacker Extradited to US Related: Crypto Scammers Hijack Microsoft’s Official X Account Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days EarlierCrypto Scammers Hijack Microsoft’s Official X AccountAI Agents Aimed SQL Injection at US and Canadian Government SitesPolice Shut Down KillSec Ransomware, Identify Alleged Teen LeaderTreasury Blacklists Most-Wanted ATM Malware Developer and His NetworkGoogle Launches Gemini 4 Argon With Guardrail-Free Access for Vetted DefendersGoogle: AI Is Changing the Pace and Profile of Vulnerability DiscoveryGovernment, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks Latest News FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM MalwareApple to Tighten Full Disk Access Controls in macOS Amid AI RisksCybersecurity M&A Roundup: 39 Deals Announced in September 2026Long-Running NPM Malware Campaign Accumulates 40,000 Downloads8.8 Million Impacted by Data Breach at Denmark’s Central Person RegisterSocial Engineering Detection Moves Into the Live ConversationGoogle Narrows Open Source Bug Bounty Amid Wave of Invalid Automated ReportsLinux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — ShinyHunters

Entities