FBI Removes Accenture Contractor After Patch Failure Exposes Thousands of Employees in ShinyHunters Breach

What Happened

The U.S. Federal Bureau of Investigation (FBI) removed an Accenture contractor after it failed to apply a security patch for Oracle PeopleSoft. The oversight allowed the ShinyHunters group to breach the FBI’s job portal and steal personal details of thousands of employees.

Impact

Personal data of an estimated 10,000+ FBI staff members was compromised. The breach highlighted a failure in third‑party patch management and exposed a critical PeopleSoft component.

Technical Details

ShinyHunters exploited CVE‑2026‑35273, a vulnerability in the Environment Management Hub (PSEMHUB) endpoint. Attackers used a URL‑encoding trick to bypass the web application firewall (WAF) rule that was intended to block the vulnerable endpoint.

"Our review determined the incident resulted from a security failure of a platform managed by a third‑party organization after a contractor failed to implement a security patch explicitly issued to secure the platform," said FBI cyber‑division assistant director Brett Leatherman.

Defender Actions

• Verify that the latest patch for Oracle PeopleSoft, addressing CVE‑2026‑35273, is installed on all affected systems.
• Review and tighten WAF rules to detect and block URL‑encoding bypass techniques.
• Conduct a rapid audit of all third‑party managed platforms for missing critical patches.
• Implement continuous monitoring for anomalous access to the Environment Management Hub endpoint.

Follow‑Up

The FBI is working with partners to pursue additional leads and has warned that more arrests may follow. Accenture has stated it remains committed to supporting the FBI’s mission.