The FBI has removed an Accenture contractor who failed to apply a security patch to the Oracle PeopleSoft system behind its job portal, according to Reuters reporting cited by The Hacker News. ShinyHunters, which claimed the breach, stole personal details of thousands of FBI employees, according to the report.
What happened
The Hacker News reported on October 6, 2026, citing Reuters, that the FBI removed the contractor after the breach. Brett Leatherman, assistant director of the FBI's cyber division, described the cause:
"the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform."
ShinyHunters claimed responsibility. In September, The Hacker News reported that the group had defaced FBIJobs.gov and claimed about 2 TB of data, including job applicant and HR data. At the time, the FBI said it was working with the third-party providers that support FBIJobs.gov. According to The Hacker News, two ShinyHunters members have been arrested, and the FBI expects more arrests.
The Leatherman quote does not name a CVE. The Hacker News places the breach alongside Mandiant's reporting that ShinyHunters (tracked as UNC6240) is exploiting CVE-2026-35273. That flaw is a CVSS 9.8 unauthenticated remote code execution bug in PeopleSoft's Environment Management Hub (PSEMHUB). Mandiant says it was exploited as a zero-day from May 27 to June 9, 2026, and Oracle issued a Security Alert on June 10. In September, the group came back with a WAF bypass. It URL-encodes one character (/%50SEMHUB/ instead of /PSEMHUB/). Rules that match the literal path miss the request, while WebLogic decodes it and routes it to the vulnerable servlet. Mandiant's post does not mention the FBI. In September, The Hacker News reported that ShinyHunters itself claimed to have used a new PeopleSoft zero-day. Treat the exact exploit path in the FBI case as reported, not confirmed.
Why it matters
This is a patch accountability failure, not a detection failure. Oracle shipped a fix in June. Mandiant also said directly that WAF rules and path-based blocking are not a substitute for patching. A virtual patch on a WAF is a temporary measure. Mandiant says the group changed its exploits to get around the WAF rules defenders had published.
PeopleSoft HR and recruiting systems are identity-adjacent in a way many teams underrate. They hold the employee and applicant records that feed joiner-mover-leaver processes, and the application tier stores credentials. Mandiant's guidance calls for rotating database connection strings, Integration Broker credentials and any cloud credentials the web tier can reach. When a contractor runs the platform, the contract usually says who patches. Your patch dashboard may still not show it. If your vulnerability management program only covers infrastructure you operate yourself, a third-party-managed HR portal can sit unpatched without anyone noticing.
What to check in your environment
- Find every PeopleSoft instance, including contractor-run ones. Confirm in writing that the Oracle Security Alert for CVE-2026-35273 has been applied, with the date. Don't accept "mitigated at the WAF" as the answer.
- Disable or remove PSEMHUB if you don't use it. Mandiant, citing Oracle's guidance, says to disable the EMHub service in multi-server setups or remove the PSEMHUB application in single-server setups. Mandiant also says that blocking EMHub and the Integration Broker listening connector from the internet does not break normal user sessions.
- Search WebLogic access logs for encoded paths. Look for requests to
/PSEMHUB/and percent-encoded variants such as/%50SEMHUB/, especiallyPOSTrequests to/huband requests for.jspfiles from external IPs, per Mandiant. - Rotate credentials the PeopleSoft tier can read if you find any sign of exposure. That includes database connection strings, Integration Broker credentials and reachable cloud credentials.
- Review database audit logs for bulk exports from HR, payroll and applicant tables. Also check for large archive files on PeopleSoft hosts.
- Add patch SLAs to third-party contracts. For every vendor or contractor that runs an internet-facing system holding your workforce data, set a required time to patch critical flaws, require proof of patching, and name the person on your side who checks it.
- Test your WAF rules against encoded input. Make sure path-based block rules match after URL decoding, not just against the raw request string.
References
- The Hacker News: FBI removes Accenture contractor after ShinyHunters breach
- Reuters: Accenture contractor removed from FBI following damaging data breach
- Mandiant: ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft
- The Hacker News: ShinyHunters claims FBI breach
- Oracle Security Alert: CVE-2026-35273