FBI Links ShinyHunters Breach to Missed Security Patch

The FBI linked a data breach affecting thousands of employees to a contractor’s failure to install a security patch on an Oracle PeopleSoft human resources system. The bureau removed the contractor responsible for the system.

The platform was managed by a third-party organization that the FBI has not publicly identified. People familiar with the matter identified the organization as Accenture. The system was connected to the FBI’s jobs website.

The FBI’s review found that the contractor failed to apply a patch issued to protect the PeopleSoft platform. The bureau said it took steps to reduce further risk and protect its workforce.

FBI cyber chief Brett Leatherman attributed the incident to “a security failure of a platform managed by a third-party organization” after the contractor failed to apply the patch. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” he added.

Accenture did not answer questions about the contractor or the patching failure. In a statement, the company said it was “proud to support the mission of the FBI and will continue to do so.”

The ShinyHunters cybercrime group claimed on Sept. 22 that it had breached FBI systems through the agency’s jobs website. The group claimed to have obtained information about FBI employees and later leaked some of the data. The exposed information reportedly included sensitive personal details.

Google had warned that ShinyHunters was targeting vulnerable PeopleSoft installations to steal data. The group claimed the FBI’s May report about its activities contained false allegations and that the attack was intended to pressure the bureau to correct or remove the report.

Law enforcement arrested an alleged ShinyHunters leader in the Netherlands on Sept. 15, before the group announced the FBI breach. The arrest of another alleged leader, Saif al-Din Khader, also known as Rey, became public on Oct. 3. Khader was reportedly arrested in Jordan and has been cooperating with authorities.

ShinyHunters continued to urge victims to negotiate and threatened to release stolen information unless they paid. The group’s website remained online, although a post urging organizations to pay had been removed.