FBI Boots Accenture Contractor After ShinyHunters Breach Traced to Unpatched System
An unpatched Oracle PeopleSoft platform. A contractor who apparently couldn't be bothered to apply the fix. And now the FBI has a data breach affecting thousands of its own employees. Classic.
The bureau has confirmed it removed an Accenture contractor following a breach by cybercrime group ShinyHunters, which claimed in September to have accessed FBI systems through the agency's jobs website. According to Reuters, which cited two sources familiar with the matter, the compromised system was Oracle's PeopleSoft HR platform, managed by Accenture on the FBI's behalf.
FBI cyber chief Brett Leatherman confirmed the root cause in a statement: a security patch that had been explicitly issued to secure the platform was never applied by the contractor responsible. The FBI says it has since removed the contractor and taken steps to limit further exposure.
Accenture, for its part, offered nothing useful. Its statement amounted to saying it's proud to work with the FBI and plans to keep doing so. No comment on the patching failure.
ShinyHunters announced the breach on 22 September, claiming they'd obtained personal information on all FBI employees, including sensitive details, some of which were leaked to journalists. The group's stated motivation was retaliatory: the FBI published a report in May warning organisations about ShinyHunters activity, and the hackers disputed its accuracy. Hacking a federal law enforcement agency to dispute your own threat profile is a bold PR strategy, to put it mildly.
The timing gets more interesting from there. An alleged ShinyHunters ringleader was arrested in the Netherlands on 15 September, a week before the breach announcement. The group responded with characteristic defiance, telling victims to keep negotiating and threatening to publish their data regardless. Then on 3 October, a second alleged leader, known as Rey, was reportedly arrested in Jordan and is said to be cooperating with authorities.
At the time of writing, the group's website remains online, though the post pressuring victims to pay has quietly disappeared. The most recent victim post is dated 22 September, which suggests activity may have slowed following the arrests.
The broader lesson here is depressingly familiar. A patch existed. It wasn't applied. A federal agency's HR data got exposed. No amount of sophisticated threat intelligence or zero-trust architecture matters if the person managing your HR system can't keep up with basic maintenance.