FBI ShinyHunters Data Breach, Contractor Removed After ShinyHunters Attack on PeopleSoft System

The FBI has removed a contractor after an internal review found that a security patch was not applied to a third-party platform involved in the agency’s recent data breach.

The FBI confirmed that the incident resulted from a security failure on a platform managed by a third-party organization, after a contractor failed to implement a security patch that had been issued to protect the platform. The bureau said it removed the contractor and took additional steps to reduce risk and protect its workforce.

The FBI has not publicly named the contractor, the third-party company, or the software in its own statement. Sources cited by Reuters identified the third-party organization as Accenture and the platform as Oracle PeopleSoft, used in connection with the FBI’s jobs portal. Reuters said it could not independently identify the individual contractor.

The attack has been attributed to ShinyHunters, a cybercrime group that has targeted PeopleSoft users. Google Threat Intelligence separately reported that ShinyHunters-linked activity was exploiting a critical PeopleSoft vulnerability, CVE-2026-35273.

There is no verified lawsuit, settlement, or claim form for this incident.

Quick Facts: FBI ShinyHunters Data Breach

Detail	What is verified
Organization affected	Federal Bureau of Investigation
Affected portal	fbijobs.gov
Group claiming responsibility	ShinyHunters
Third-party organization (per sources, not named by FBI)	Accenture
Software (per sources, not named by FBI)	Oracle PeopleSoft
Vulnerability tied to ShinyHunters activity	CVE-2026-35273
FBI-confirmed action	Contractor removed
FBI’s stated cause	Failure to implement an issued security patch on a third-party-managed platform
Number of people affected	Not established by the FBI
Case number	None publicly identified
Civil lawsuit	None verified
Settlement / claim form	None
Current status	FBI investigation and mitigation ongoing

What Did the FBI Confirm?

On September 23, 2026, the FBI publicly acknowledged that a cybercriminal group was claiming to have compromised fbijobs.gov, with alleged impact on FBI employee personally identifiable information (PII). At that time the bureau said it had not determined whether the breach originated through a third-party provider or its own enterprise systems, and that it was working with third-party providers supporting the portal.

Later, Brett Leatherman, assistant director of the FBI’s Cyber Division, said the review found a security failure on a third-party-managed platform after a contractor failed to implement a patch specifically issued to secure it. The FBI said it removed the contractor and has taken steps to mitigate further risk.

How Was Accenture Connected?

The FBI’s statement does not name Accenture. Reuters reported that two sources familiar with the matter identified Accenture as the organization managing the affected platform and the platform as Oracle PeopleSoft. Accenture told Reuters it was proud to support the FBI’s mission but did not address the contractor allegations.

This article therefore treats the Accenture and PeopleSoft identifications as reported information, not FBI-confirmed facts.

What Is Oracle’s CVE-2026-35273 Vulnerability?

Oracle issued a security alert on June 10, 2026 for CVE-2026-35273, a vulnerability affecting Oracle PeopleSoft PeopleTools. Oracle rated it 9.8 under CVSS 3.1 (critical), said it could be exploited remotely without authentication, and said a successful attack could allow remote code execution. The affected supported versions are PeopleTools 8.61 and 8.62. Oracle advised customers to apply security updates without delay.

Related article: Deera Express $27,500 Overtime Settlement, What Former Delivery Drivers Should Know

How Did ShinyHunters Exploit PeopleSoft?

Google Threat Intelligence (Mandiant) reported in September that ShinyHunters-linked activity had moved from earlier zero-day exploitation to renewed exploitation of unpatched systems. Attackers modified their exploit to bypass certain web application firewall rules by using URL encoding to disguise the request to the vulnerable PeopleSoft Environment Management Hub endpoint.

Mandiant’s conclusion: firewall rules were not a substitute for installing the actual Oracle patch. That finding is consistent with the FBI’s statement that a patch was not applied.

ShinyHunters has publicly claimed it stole roughly 2 to 3 terabytes of data from FBI-related systems. That figure is the group’s own claim and has not been confirmed by the FBI.

What Information Was Reportedly Exposed?

The FBI has not published a final accounting. Reuters reported that exposed information reportedly included details tied to sensitive counterintelligence roles, addresses of human-intelligence personnel, and medical and psychiatric information. Because the investigation is ongoing, treat any specific count of affected people or definitive list of records with caution. The FBI has not published a final figure for how many individuals were affected.

Who May Be Affected?

FBI employees: potentially. The FBI’s September 23 statement specifically referred to alleged impact on employee PII, and the bureau said it acted to protect its workforce.

Job applicants: potentially. The initial statement concerned fbijobs.gov, the FBI’s employment website, so people who used it are a potentially relevant group. But the FBI has not confirmed that everyone who used the portal was affected, so it would be inaccurate to tell every past applicant their data was definitely stolen.

Rely on direct notices from the FBI or other official government channels, not unsolicited messages offering breach help.

Is There a Lawsuit, Settlement, or Claim Form?

No. No verified civil lawsuit or putative class action has been identified, and there is no class certification, settlement fund, claims administrator, claim form, or deadline. The FBI’s removal of a contractor is not a legal finding of liability. The FBI has acknowledged the investigation and mitigation steps, but that is different from a compensation program. Be cautious of websites advertising an FBI-ShinyHunters claim deadline or guaranteed payment. If a lawsuit or official remedy is later established, an official notice would contain the instructions and deadlines.

What Affected People Should Do

• Watch for official FBI communications about whether your information was involved, and keep any notice you receive.
• Consider a fraud alert or credit freeze with the major credit bureaus, and monitor financial accounts and credit reports for unusual activity.
• Use official government identity-theft resources if suspicious activity appears.
• Watch for phishing. Employment records can give criminals enough detail to make impersonation attempts convincing.
• Never give your Social Security number, bank information, or other sensitive data to anyone who contacts you unexpectedly claiming to represent the FBI, a settlement administrator, or an investigator.

What This Means for Other PeopleSoft Users

The incident is not only a government problem. Mandiant said observed victims of the ShinyHunters campaign spanned higher education, technology, IT services, healthcare, agriculture, transportation, and government. Organizations running PeopleSoft PeopleTools 8.61 or 8.62 should apply Oracle’s security update, and Mandiant also recommends disabling or removing the vulnerable Environment Management Hub where appropriate and reviewing logs for signs of exploitation.

What Happens Next

The FBI’s investigation continues. The contractor removal shows the review has identified at least one security failure involving a missed patch, but important questions remain publicly unresolved, including the full scope of data accessed, the total number of people affected, and the complete chain of events. Any notification to individuals, credit-monitoring offer, or action against a contractor would come from the FBI or contracting authorities. Private litigation, if it arises, would begin with individual or class complaints in court, and none has been reported.

Key Dates

Date	Development
June 10, 2026	Oracle issues security alert for CVE-2026-35273
June 11, 2026	Google/Mandiant describes active ShinyHunters exploitation of PeopleSoft
September 23, 2026	FBI acknowledges the claimed compromise of fbijobs.gov
September 25, 2026	Mandiant reports renewed mass exploitation of CVE-2026-35273
October 6, 2026	Reports emerge that the FBI removed a contractor
October 7, 2026	FBI contractor-removal update

Frequently Asked Questions

Did the FBI confirm that Accenture caused the breach?

 No. The FBI confirmed a third-party platform security failure after a contractor missed a patch, but did not name Accenture. Reuters reported, citing two sources, that Accenture was the third-party organization.

Did the FBI confirm that Oracle PeopleSoft was breached?

 The FBI’s statement did not name PeopleSoft. Reuters reported, based on sources, that PeopleSoft was the platform.

Which vulnerability is connected to the ShinyHunters campaign?

 CVE-2026-35273, a critical Oracle PeopleSoft vulnerability rated 9.8 under CVSS 3.1.

How many people were affected? 

The FBI has not published a confirmed number.

Was the contractor fired? 

The FBI said it removed the contractor and did not identify the individual.

Is there an FBI data breach lawsuit or claim form? 

No. No verified lawsuit, settlement, claim form, or compensation program exists.

Should FBI employees apply for compensation now?

 No public program exists. Rely on official FBI communications, not third-party sites promising payments.

Related AllAboutLawyer Coverage

For a separate data-breach matter involving third-party handling of sensitive information, see Hawaii Joins $2,287,455 Labcorp Data Breach Settlement With 43 Other States, No Consumer Claim Form. That case involves a multistate government settlement and is unrelated to the FBI incident.

Sources

• FBI, “FBI Statement on Compromise of fbijobs.gov Portal and Alleged Impact to FBI Employee PII”: https://www.fbi.gov/news/press-releases/fbi-statement-on-compromise-of-fbijobsgov-portal-and-alleged-impact-to-fbi-employee-pii
• Nextgov/FCW, “FBI removes Accenture contractor after missed security patch led to breach”: https://www.nextgov.com/cybersecurity/2026/10/fbi-removes-accenture-contractor-after-missed-security-patch-led-breach/416441/
• Reuters, “Accenture contractor removed from FBI following damaging data breach, sources say”: https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/
• Oracle Security Alert for CVE-2026-35273: https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
• Google Cloud / Mandiant, “ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft”: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
• Google Cloud / Mandiant, “ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit”: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/

Researched and written by Israr Ahmad, Legal Content Researcher.

This article is for informational purposes only and is not legal advice. AllAboutLawyer.com is a U.S. consumer legal information website, not a law firm, and does not provide legal representation. Official FBI statements and any future court filings are the authoritative sources. Individuals who believe their information was affected should follow official guidance and consult appropriate professionals as needed.