The FBI says the ShinyHunters intrusion into its systems happened because a contractor did not apply a security patch to a platform managed by an outside organization, SecurityWeek reported Tuesday. Reuters, citing two people familiar with the matter, reported that the contractor worked for Accenture and that the system was Oracle's PeopleSoft human resources platform.

What Happened

Brett Leatherman, assistant director of the FBI's Cyber Division, said the bureau's review so far had traced the incident to a security failure on a third-party-managed platform after a contractor failed to implement a patch "explicitly issued to secure the platform." He said the FBI had removed the contractor and taken steps to limit further risk and protect its workforce.

The bureau has not publicly named the contractor or the company that ran the platform. The Accenture and PeopleSoft details come from Reuters' sources. Asked about the contractor and the missed patch, Accenture did not address the specifics, saying only that it is proud to support the FBI's mission and will continue to do so, according to SecurityWeek.

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350

Personal information belonging to thousands of FBI employees was exposed. The exact number of people affected and the full range of data taken have not been confirmed. ShinyHunters has claimed it obtained information on essentially all bureau employees.

The Hacker News, which also covered the FBI's statement, linked the intrusion to CVE-2026-35273, a flaw in PeopleSoft's Environment Management Hub, or PSEMHUB, endpoint.

Why It Matters

The FBI's explanation turns a story about a criminal group's reach into one about patch management in the government's supply chain. The flaw at the center of the case was not new. As The Primary Wire reported Sept. 28, Google Threat Intelligence Group and Mandiant said ShinyHunters had returned to CVE-2026-35273 with a URL-encoding trick that slipped past web application firewall rules meant to block the vulnerable path. That technique worked against organizations that had relied on the workaround without installing Oracle's fix, which is the kind of gap the FBI now describes.

Placing the failure with a contractor also raises questions for other agencies that run PeopleSoft through outside integrators. A patch the vendor had already released went unapplied on a system holding sensitive personnel records, and the bureau has not said how long it remained open.

The Case So Far

ShinyHunters announced the FBI breach Sept. 22, saying it had hit the bureau's jobs and recruiting infrastructure. Later reporting, including samples reviewed by The New York Times, described stolen records that tied staff to sensitive assignments, which The Primary Wire covered in September.

Two alleged members have since been detained. Dutch police arrested a 24-year-old in Amsterdam on Sept. 15, and a suspect known as Rey was detained in Jordan, where, according to Reuters, he is helping the FBI identify other members.

What to Watch

The open questions are how many people were affected and what categories of data were taken, whether other federal agencies run similarly unpatched PeopleSoft deployments, and whether the episode affects Accenture's federal work. Reports say the FBI's review is continuing and that more arrests are expected.