The FBI removed an Accenture contractor on Monday after a data breach exposed sensitive personal details of thousands of bureau employees, Reuters reported. FBI cyber chief Brett Leatherman said the incident “occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform.”
More info here: FBI removes Accenture contractor after ShinyHunters data breach
Jason Brown, Director of Customer Advisory, Counter Fraud Lead, iCOUNTER
“The FBI breach came through a PeopleSoft HR platform that a third party managed. According to the FBI, a contractor failed to apply a patch that Oracle and Google flagged as critical back in June. ShinyHunters claims it got in through that flaw in September. Third-party risk lives in that gap. Organizations hand third parties some of their most sensitive systems and then have very little insight into whether those systems are patched, monitored or exposed. In this case, Reuters reports the result was counterintelligence role descriptions, home addresses of human intelligence operatives, and medical and psychiatric records for bureau employees. Every contract for a managed platform should spell out how quickly critical patches have to be applied, require the third party to prove it was done, and give the customer the right to check. Security teams also need to stop treating third-party managed systems as someone else’s problem. Keep an inventory of every platform a third party runs on your behalf, know what data sits in it, and watch for warning signs, like that platform showing up in exploit activity or criminal forums. Groups like ShinyHunters look for exactly this kind of weak link, because one unpatched platform at a contractor can expose an entire workforce. Intelligence on which of your third parties are being actively targeted gives you a chance to act before the data is gone. Outsourcing the platform leaves the accountability with you. When it’s your employees’ data, the breach is yours.”
ShinyHunters is busy for sure. Thus proving that this wasn’t going to stop them. Thus if I were you, I would harden things up so that ShinyHunters don’t get in at all.
UPDATE; More commentary has come in.
Justin Beals, CEO & Founder, Strike Graph
“The FBI deserves credit for saying plainly what happened. A contractor failed to apply a patch that was explicitly issued to secure the platform, and the bureau named that as the cause and removed the contractor. Most organizations would bury that finding. The harder truth is that the FBI’s workforce data was only as secure as the patch cadence of a team it didn’t directly manage.
Federal contracting keeps running into this gap. Agencies and primes collect attestations that controls are in place, but an attestation only tells you what a vendor intended to do. It doesn’t tell you whether the patch went in after Google warned that ShinyHunters was going after vulnerable PeopleSoft instances. A DHS prime contractor I work with put it to me directly when we were talking about his obligations as an affirming official: ‘I don’t think a security questionnaire is going to cut it.’ He’s right. A questionnaire is self-attested and unverifiable, and he’s signing for every subcontractor below him.
Expect this to show up in enforcement. DOJ recovered $52 million under its Civil Cyber-Fraud Initiative in FY2025, and those cases turn on the gap between what a contractor said about its controls and what was actually running. Removing the contractor was the right call, but it happened after the damage was done. The agencies and primes that avoid the next headline will be the ones requiring continuous evidence from their suppliers, including time-to-patch on critical systems, rather than a form that gets filed once and never revisited.”
Joe Brinkley, Director of Offensive Security Research & Community, Cobalt
“Outsourcing the management of a platform doesn’t outsource the risk that comes with it. Attackers understand this well, which is why groups like ShinyHunters focus on widely deployed enterprise applications where responsibility for patching sits somewhere between the customer and the service provider. When ownership is split, critical updates tend to fall into the gap, and that gap is where real-world exploitation happens. The approach also scales well for attackers: once they have a working method against one platform, they can sweep the internet for every instance that’s lagging behind, regardless of who manages it. Organizations need to treat third-party-managed systems as part of their own attack surface. That means setting clear contractual ownership of remediation timelines and independently validating that patches were actually applied, because a status report is not evidence that the exposure is gone. The organizations that hold up best test their trusted relationships the same way an attacker would, rather than assuming someone else has it covered.”
UPDATE #2: Kevin Surace, CEO, Token said this:
“What makes this incident so troubling is that this was not some mysterious new zero day attack. It was a well known, critical vulnerability rated 9.8 out of 10, which essentially means patch it urgently, and Oracle had already issued the fix. Accenture reportedly failed to implement that patch, leaving the vulnerable system exposed. ShinyHunters was likely scanning large numbers of systems looking for exactly this situation: an internet facing endpoint that remained unpatched. They found one. The attackers did not need to invent a sophisticated new technique; they simply exploited a known vulnerability that should have already been closed.
“This was an entirely preventable breach and a stark reminder that basic patch management remains one of the most important disciplines in cybersecurity.”
Related
This entry was posted on October 6, 2026 at 12:08 pm and is filed under Commentary with tags FBI. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
FBI removes Accenture contractor after an unpatched third-party PeopleSoft platform exposed employees’ counterintelligence roles and medical records
The FBI removed an Accenture contractor on Monday after a data breach exposed sensitive personal details of thousands of bureau employees, Reuters reported. FBI cyber chief Brett Leatherman said the incident “occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform.”
More info here: FBI removes Accenture contractor after ShinyHunters data breach
Jason Brown, Director of Customer Advisory, Counter Fraud Lead, iCOUNTER
“The FBI breach came through a PeopleSoft HR platform that a third party managed. According to the FBI, a contractor failed to apply a patch that Oracle and Google flagged as critical back in June. ShinyHunters claims it got in through that flaw in September. Third-party risk lives in that gap. Organizations hand third parties some of their most sensitive systems and then have very little insight into whether those systems are patched, monitored or exposed. In this case, Reuters reports the result was counterintelligence role descriptions, home addresses of human intelligence operatives, and medical and psychiatric records for bureau employees. Every contract for a managed platform should spell out how quickly critical patches have to be applied, require the third party to prove it was done, and give the customer the right to check. Security teams also need to stop treating third-party managed systems as someone else’s problem. Keep an inventory of every platform a third party runs on your behalf, know what data sits in it, and watch for warning signs, like that platform showing up in exploit activity or criminal forums. Groups like ShinyHunters look for exactly this kind of weak link, because one unpatched platform at a contractor can expose an entire workforce. Intelligence on which of your third parties are being actively targeted gives you a chance to act before the data is gone. Outsourcing the platform leaves the accountability with you. When it’s your employees’ data, the breach is yours.”
ShinyHunters is busy for sure. Thus proving that this wasn’t going to stop them. Thus if I were you, I would harden things up so that ShinyHunters don’t get in at all.
UPDATE; More commentary has come in.
Justin Beals, CEO & Founder, Strike Graph
“The FBI deserves credit for saying plainly what happened. A contractor failed to apply a patch that was explicitly issued to secure the platform, and the bureau named that as the cause and removed the contractor. Most organizations would bury that finding. The harder truth is that the FBI’s workforce data was only as secure as the patch cadence of a team it didn’t directly manage.
Federal contracting keeps running into this gap. Agencies and primes collect attestations that controls are in place, but an attestation only tells you what a vendor intended to do. It doesn’t tell you whether the patch went in after Google warned that ShinyHunters was going after vulnerable PeopleSoft instances. A DHS prime contractor I work with put it to me directly when we were talking about his obligations as an affirming official: ‘I don’t think a security questionnaire is going to cut it.’ He’s right. A questionnaire is self-attested and unverifiable, and he’s signing for every subcontractor below him.
Expect this to show up in enforcement. DOJ recovered $52 million under its Civil Cyber-Fraud Initiative in FY2025, and those cases turn on the gap between what a contractor said about its controls and what was actually running. Removing the contractor was the right call, but it happened after the damage was done. The agencies and primes that avoid the next headline will be the ones requiring continuous evidence from their suppliers, including time-to-patch on critical systems, rather than a form that gets filed once and never revisited.”
Joe Brinkley, Director of Offensive Security Research & Community, Cobalt
“Outsourcing the management of a platform doesn’t outsource the risk that comes with it. Attackers understand this well, which is why groups like ShinyHunters focus on widely deployed enterprise applications where responsibility for patching sits somewhere between the customer and the service provider. When ownership is split, critical updates tend to fall into the gap, and that gap is where real-world exploitation happens. The approach also scales well for attackers: once they have a working method against one platform, they can sweep the internet for every instance that’s lagging behind, regardless of who manages it. Organizations need to treat third-party-managed systems as part of their own attack surface. That means setting clear contractual ownership of remediation timelines and independently validating that patches were actually applied, because a status report is not evidence that the exposure is gone. The organizations that hold up best test their trusted relationships the same way an attacker would, rather than assuming someone else has it covered.”
UPDATE #2: Kevin Surace, CEO, Token said this:
“What makes this incident so troubling is that this was not some mysterious new zero day attack. It was a well known, critical vulnerability rated 9.8 out of 10, which essentially means patch it urgently, and Oracle had already issued the fix. Accenture reportedly failed to implement that patch, leaving the vulnerable system exposed. ShinyHunters was likely scanning large numbers of systems looking for exactly this situation: an internet facing endpoint that remained unpatched. They found one. The attackers did not need to invent a sophisticated new technique; they simply exploited a known vulnerability that should have already been closed.
“This was an entirely preventable breach and a stark reminder that basic patch management remains one of the most important disciplines in cybersecurity.”
Share this:
Like this:
Related
This entry was posted on October 6, 2026 at 12:08 pm and is filed under Commentary with tags FBI. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.