FBI Boots Accenture Contractor Over Unpatched System That Handed ShinyHunters Thousands of Agent Records

An Accenture contractor has been shown the door by the FBI after an unpatched vulnerability in a third-party platform gave the ShinyHunters hacking group access to personal data belonging to thousands of bureau employees.

Reuters broke the story, citing two people with direct knowledge of the situation. Brett Leatherman, assistant director of the FBI's cyber division, confirmed the contractor had failed to apply a security patch that was specifically issued to protect the affected platform. In other words, someone had the fix, chose not to deploy it, and here we are.

"The FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce," Leatherman told Reuters.

The FBI didn't name the platform involved, but Reuters connected the dots: it's Oracle PeopleSoft, the same system ShinyHunters claimed to have exploited when they hit the bureau's job portal last month. Mandiant, now under Google's ownership, published analysis suggesting the group bypassed CVE-2026-35273 protections using a URL-encoding trick to slip past a web application firewall rule blocking access to the vulnerable PSEMHUB endpoint. Neat, if you're into that sort of thing.

Accenture, never one to miss a PR opportunity, told Reuters it was "proud to support the mission of the FBI and will continue to do so." Quite the statement when one of your people apparently left a known security hole open on a federal law enforcement network.

This is far from the end of the story. Two ShinyHunters members have already been arrested, and the FBI has made clear that more are coming. The agency says it's still working through leads with partners and the investigation remains very much active.

The core lesson here is embarrassingly basic: patch your systems. Especially when you're managing infrastructure for the FBI. Especially when a patch has been explicitly issued to fix a known flaw. This wasn't a zero-day. Someone just didn't bother.