The FBI has removed a contractor it blames for leaving a known hole open in the system that held its own job applicants’ and employees’ records. Two sources told Reuters the removal took place on Monday, October 5. FBI cyber chief Brett Leatherman said the breach was the result of a security failure on a platform run by a third party, after a contractor “failed to implement a security patch explicitly issued to secure the platform”.
What was taken
The extortion group ShinyHunters claimed on September 22 that it had broken into the bureau’s jobs portal, which it defaced. It said it had taken 2 to 3 terabytes of data on agents and applicants, and it demanded that the FBI retract a May advisory about its tactics within a week. As proof it shared a sample of roughly 5,000 records. The Associated Press reported that the sample held names, home addresses, phone numbers and details tied to some employees’ spouses.
Reuters later reported that the exposed material went well beyond that. It included granular descriptions of named employees’ counterintelligence jobs, the street addresses of human intelligence operatives, and medical and psychiatric records of bureau staff. The detail that matters is the addresses: for an operative, a leaked home address is closer to a targeting list than a privacy slip. Some former bureau officials have called the breach a major blow to operational security.
The patch that was not applied
The FBI did not name the platform or the third party. Reuters’ two sources said it was Oracle’s PeopleSoft, the system ShinyHunters said it exploited, and that the third party was Accenture. Accenture said it was “proud to support the mission of the FBI” and answered no questions about the contractor or the alleged lapse. Oracle did not immediately reply to Reuters. The contractor’s identity and employment status were not established.
The timeline is not flattering. Oracle disclosed CVE-2026-35273 on June 10, 2026, a remote code execution flaw in PeopleSoft’s PeopleTools Environment Management Hub, rated 9.8 out of 10 on the CVSS scale. A day later, Google’s Threat Intelligence Group and Mandiant said ShinyHunters, which they track as UNC6240, had been exploiting it as a zero-day since May 27. More than 100 organizations were hit in that campaign, and higher education made up 68% of the victims. Google and Oracle both urged PeopleSoft users to apply all critical patches without delay. Reuters could not determine whether or when those responsible for the FBI site followed that advice.
Under the hood, the group also showed why a firewall is no substitute for a fix. Mandiant found that ShinyHunters got past web application firewall rules guarding the /PSEMHUB/ path by sending requests to /%50SEMHUB/, swapping the letter P for its percent-encoded form. The rules watched for the plain-text path. PeopleSoft decoded the request anyway and passed it to the vulnerable servlet.
Open questions
Patching enterprise software is laborious, as Reuters noted, particularly when it serves large numbers of people. Even so, the bureau has not said how many people were affected or whether it is offering protection to the operatives and families named in the data. Last week, Reuters reported, a key ShinyHunters suspect was detained in Jordan, and sources said he was cooperating, which may help the FBI understand how far the damage runs. Startup Fortune pointed out that PeopleSoft also runs inside other federal agencies and large universities, so whatever let the patch sit at the FBI was probably not unique to it.
Sources
- FBI removes Accenture contractor for alleged involvement in a data breach that exposed details of thousands of employees | Company Business News
- FBI fires Accenture contractor after ShinyHunters breach exposes agents – Startup Fortune
