A cybersecurity incident at the FBI, potentially compromising data on thousands of its employees, has prompted the bureau to cut ties with an Accenture contractor. An insider familiar with the situation attributed the breach to the contractor’s neglect in applying a critical security update.
Prolific cybercrime group ShinyHunters claimed responsibility for the hack, which stole employees’ addresses, phone numbers, and information on their spouses. The data also included sensitive information on employees’ intelligence and surveillance roles, as well as private medical information.
Accenture is responsible for software patch management and maintaining custom code at the FBI. Oracle provided the security patches that were not integrated, according to the person. The initial access point exploited by ShinyHunters was Oracle’s PeopleSoft platform.
FBI cybersecurity chief Brett Leatherman confirmed the removal of the contractor, stating that the incident occurred due to a security failure of a platform managed by a third-party organization. Leatherman said the contractor failed to implement a security patch explicitly issued to secure the platform.
The FBI has taken steps to mitigate any further risk and protect its workforce. The breach poses serious counterintelligence risks, as the exposed records could help foreign intelligence services identify employees working on sensitive investigations and exploit personal information about them.
ShinyHunters has said it would not publish the stolen data, but its statement did not say the records had been deleted. Retired Lt. Gen. Robert Skinner said the group could still sell some or all of the information to foreign intelligence services or other buyers. Authorities have also moved against suspected members of the group, with Dutch police announcing the arrest of an alleged leader and another suspected member detained in Jordan.
In this case, the failure to apply an available fix led to a significant breach.
