FBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.
The FBI has removed a contractor it holds responsible for the September breach that exposed personal details of thousands of bureau employees, according to Reuters and The Hacker News. Brett Leatherman, assistant director of the FBI Cyber Division, said the incident came from a security failure on a platform managed by a third-party organization, after a contractor failed to apply a patch issued specifically to secure it. The FBI named neither company. Reuters, citing sources, identified the platform as Oracle PeopleSoft and the contractor's employer as Accenture, which said it was proud to support the FBI and did not discuss the individual. ShinyHunters had claimed it breached the FBI's jobs portal through PeopleSoft. Mandiant has separately tied the group to exploitation of PeopleSoft flaw CVE-2026-35273, though the FBI has not said which flaw was used here.
Why it matters
PeopleSoft is a human resources system, which makes it the authoritative source of workforce identity data, and its contents are exactly what an attacker needs to impersonate staff to a help desk or target them by phone. The control that failed was not authentication but patch ownership: the FBI outsourced operation of the platform, and the review found the patch was never applied. Outsourcing the work does not outsource the risk.
Two checks follow. First, list every system that holds employee identity records (HR, payroll, recruiting portals) and confirm who applies patches, under what deadline, and how you verify it happened rather than taking the contract on trust. Second, if your staff records leak, expect help-desk social engineering and vishing to follow, and tighten identity verification for resets before that happens. For background on the group, see our coverage of the Dutch arrest in the ShinyHunters investigation, which covers the same PeopleSoft WAF-bypass exploitation.
Update, October 28, 2026: FBI Director Kash Patel said on October 9 that the bureau had arrested "another suspected co-conspirator" of ShinyHunters, which it holds responsible for the FBIJobs.gov incident, according to BleepingComputer. CyberScoop identified a man arrested in Pennsylvania on October 8 as Edward Dubrovsky, a former managing director at incident response firm CYPFER, charged with conspiracy to extort through threats to disclose data and Hobbs Act extortion conspiracy in a case moved to the Eastern District of Texas. The FBI has not confirmed he is the person Patel described, and the charges do not mention the FBI breach.
Source: The Hacker News
Related on Start with Identity
- BlogASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third
- BlogDigiCert says self-registered accounts read archived customer data, including some ID documents
DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 an
- BlogWorkOS says an AI-assisted attack framework reached its internal sales tool and CRM data
WorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directo
- ArticleCyberArk Alternatives in 2026: 6 PAM Options Compared After the Idira Rebrand
CyberArk is now Idira, inside Palo Alto Networks, and the vendor neutrality many buyers chose it for is gone. Six alternatives compared on depth, operational we
- GlossaryFan-Out Breach
A fan-out breach is an incident in which one compromised identity or credential store at a provider (a support account, an integration's OAuth tokens, an app se
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.