25
The US Federal Bureau of Investigation (FBI) has removed an Accenture contractor following a data breach that exposed sensitive personal nformation belonging to thousands of bureau
employees, Reuters reported on October 6, citing two sources familiar with the matter.
The incident was linked to a failure to apply a security patch to a third-party-managed platform, according to FBI cyber chief Brett Leatherman. The FBI said it had removed the contractor and taken steps to mitigate further risks and protect its workforce.
The FBI did not publicly identify the platform or the third-party organisation involved. However, sources cited by Reuters identified the platform as Oracle's PeopleSoft human resources software and the service provider as Accenture. Reuters said it could not independently identify the contractor or establish their current employment status.
The breach has raised concerns about the security of systems used to manage sensitive employee information. According to Reuters, the hacking group ShinyHunters claimed in September that it had breached the FBI's job site by exploiting a vulnerability in PeopleSoft.
The incident followed security warnings issued in June. Google raised concerns about a ShinyHunters-linked hacking and extortion campaign targeting organisations using PeopleSoft, while Oracle issued a security alert identifying a vulnerability and providing security fixes.
Both companies urged organisations using the software to apply critical security updates Reuters reported that it could not determine whether or when the recommended security updates had been applied to the FBI’s job site.
The breach reportedly exposed detailed information about FBI employees, including descriptions of counterintelligence roles, home addresses of human intelligence operatives, and medical and psychiatric records.
The extent of the damage remains under assessment. The incident has also raised concerns within the wider intelligence community about the potential consequences of security failures involving systems that handle sensitive government personnel data.
In a statement to Reuters, Accenture said it was proud to support the FBI's mission and would continue to do so. The company did not directly address questions about the contractor or the alleged failure to apply the security patch.
The incident highlights the importance of timely security updates, particularly for enterprise platforms that store sensitive information. It also underscores the risks organisations face when critical systems are managed by external service providers.
The incident was linked to a failure to apply a security patch to a third-party-managed platform, according to FBI cyber chief Brett Leatherman. The FBI said it had removed the contractor and taken steps to mitigate further risks and protect its workforce.
The FBI did not publicly identify the platform or the third-party organisation involved. However, sources cited by Reuters identified the platform as Oracle's PeopleSoft human resources software and the service provider as Accenture. Reuters said it could not independently identify the contractor or establish their current employment status.
The breach has raised concerns about the security of systems used to manage sensitive employee information. According to Reuters, the hacking group ShinyHunters claimed in September that it had breached the FBI's job site by exploiting a vulnerability in PeopleSoft.
The incident followed security warnings issued in June. Google raised concerns about a ShinyHunters-linked hacking and extortion campaign targeting organisations using PeopleSoft, while Oracle issued a security alert identifying a vulnerability and providing security fixes.
Both companies urged organisations using the software to apply critical security updates Reuters reported that it could not determine whether or when the recommended security updates had been applied to the FBI’s job site.
The breach reportedly exposed detailed information about FBI employees, including descriptions of counterintelligence roles, home addresses of human intelligence operatives, and medical and psychiatric records.
The extent of the damage remains under assessment. The incident has also raised concerns within the wider intelligence community about the potential consequences of security failures involving systems that handle sensitive government personnel data.
In a statement to Reuters, Accenture said it was proud to support the FBI's mission and would continue to do so. The company did not directly address questions about the contractor or the alleged failure to apply the security patch.
The incident highlights the importance of timely security updates, particularly for enterprise platforms that store sensitive information. It also underscores the risks organisations face when critical systems are managed by external service providers.
