Accenture sign above an entrance in Zurich, Switzerland, in November 2022 Credit: Tobias Arhelger via Shutterstock An Accenture contractor has been removed from FBI work following a breach that exposed the personal data of thousands of bureau staff. The FBI acted on Monday, Reuters reported, citing two people familiar with the matter. A senior FBI official told Reuters that an unnamed contractor had not applied a security fix, known as a patch, to a system in its care. The bureau did not name the company or the platform, and we have not independently verified the report. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” the official told Reuters.
Reuters’ two sources filled in the gaps, saying the platform was Oracle PeopleSoft, a human resources system, and that the third party responsible for it was Accenture. ShinyHunters, a group that steals data and demands payment, said last month that it had used a PeopleSoft flaw to break into the FBI’s jobs portal. At the time, the group said it held data on almost all FBI agents and on people who had applied to work for the FBI. Accenture told Reuters it was proud to support the FBI and would continue to do so.
But the firm did not respond to questions about the contractor or the missed patch. The group said the attack was an act of revenge, not a bid for money. It said it targeted the FBI over a May advisory about its methods and demanded that the bureau correct the advisory instead of paying a ransom. Meanwhile, the route in remains unconfirmed.
Earlier this year, between May and June, ShinyHunters used a separate PeopleSoft flaw against mostly academic targets before Oracle released a fix, Help Net Security reported, citing Mandiant. Neither the FBI nor Reuters has said whether the same flaw was used here. Some former FBI officials have described the breach as a major blow to the bureau’s operational security, according to Reuters. Two members of ShinyHunters have since been arrested, The Hacker News reported, while the FBI is still determining how far the damage goes.
Leave a Reply