FBI dismisses Accenture contractor after patch lapse enabled ShinyHunters breach

The Federal Bureau of Investigation has terminated an Accenture contractor it says failed to apply a security patch that protected a platform used by the agency, leading to a data breach by the hacking group ShinyHunters. The breach exposed personal information of thousands of FBI employees.

"To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform," Brett Leatherman, assistant director of the FBI's cyber division, told Reuters. "As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce."

The platform involved is believed to be Oracle PeopleSoft, which ShinyHunters exploited to infiltrate the FBI's job portal. According to Mandiant, the group used a URL-encoding technique to bypass a web application firewall rule protecting the vulnerable Environment Management Hub endpoint (CVE-2026-35273).

Accenture said it remains committed to supporting the FBI's mission. The FBI indicated that investigations are ongoing, with two members of ShinyHunters already arrested and further arrests expected as the agency follows additional leads.