ShinyHunters Breached FBI After Contractor Failed to Install Software Patch

Don't forget to patch: The FBI is blaming the embarrassing ShinyHunters breach on a contractor who neglected to update their software, leaving the agency's IT system vulnerable to hacking. Reuters, which first reported the news, says the contractor worked for consulting and IT services provider Accenture. In a statement to PCMag, the FBI’s Assistant Director Brett Leatherman added: “To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization—after a contractor failed to implement a security patch explicitly issued to secure the platform.” “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” the agency added. The resulting breach enabled a notorious cybercriminal gang known as ShinyHunters to steal the personal information of possibly all FBI agents, including undercover operatives. The group pulled off the heist by exploiting a software vulnerability in Oracle’s PeopleSoft product, using the FBI’s online jobs board as an entry point, a ShinyHunters member told PCMag. But there are signs that a PeopleSoft software vulnerability, publicly known as CVE-2026-35273, was patched in June, three months before ShinyHunters announced it had hit the FBI. The group was spotted exploiting the flaw back in late May. But two weeks ago, right after the FBI breach, Google’s Mandiant cybersecurity division warned that ShinyHunters had “renewed mass exploitation” of CVE-2026-35273 to attack a large number of sectors, including governments. Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

Reuters, which first reported the news, says the contractor worked for consulting and IT services provider Accenture. In a statement to PCMag, the FBI’s Assistant Director Brett Leatherman added: “To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization—after a contractor failed to implement a security patch explicitly issued to secure the platform.” “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” the agency added. The resulting breach enabled a notorious cybercriminal gang known as ShinyHunters to steal the personal information of possibly all FBI agents, including undercover operatives. The group pulled off the heist by exploiting a software vulnerability in Oracle’s PeopleSoft product, using the FBI’s online jobs board as an entry point, a ShinyHunters member told PCMag. But there are signs that a PeopleSoft software vulnerability, publicly known as CVE-2026-35273, was patched in June, three months before ShinyHunters announced it had hit the FBI. The group was spotted exploiting the flaw back in late May. But two weeks ago, right after the FBI breach, Google’s Mandiant cybersecurity division warned that ShinyHunters had “renewed mass exploitation” of CVE-2026-35273 to attack a large number of sectors, including governments. Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

“As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” the agency added. The resulting breach enabled a notorious cybercriminal gang known as ShinyHunters to steal the personal information of possibly all FBI agents, including undercover operatives. The group pulled off the heist by exploiting a software vulnerability in Oracle’s PeopleSoft product, using the FBI’s online jobs board as an entry point, a ShinyHunters member told PCMag. But there are signs that a PeopleSoft software vulnerability, publicly known as CVE-2026-35273, was patched in June, three months before ShinyHunters announced it had hit the FBI. The group was spotted exploiting the flaw back in late May. But two weeks ago, right after the FBI breach, Google’s Mandiant cybersecurity division warned that ShinyHunters had “renewed mass exploitation” of CVE-2026-35273 to attack a large number of sectors, including governments. Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

The resulting breach enabled a notorious cybercriminal gang known as ShinyHunters to steal the personal information of possibly all FBI agents, including undercover operatives. The group pulled off the heist by exploiting a software vulnerability in Oracle’s PeopleSoft product, using the FBI’s online jobs board as an entry point, a ShinyHunters member told PCMag. But there are signs that a PeopleSoft software vulnerability, publicly known as CVE-2026-35273, was patched in June, three months before ShinyHunters announced it had hit the FBI. The group was spotted exploiting the flaw back in late May. But two weeks ago, right after the FBI breach, Google’s Mandiant cybersecurity division warned that ShinyHunters had “renewed mass exploitation” of CVE-2026-35273 to attack a large number of sectors, including governments. Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

But there are signs that a PeopleSoft software vulnerability, publicly known as CVE-2026-35273, was patched in June, three months before ShinyHunters announced it had hit the FBI. The group was spotted exploiting the flaw back in late May. But two weeks ago, right after the FBI breach, Google’s Mandiant cybersecurity division warned that ShinyHunters had “renewed mass exploitation” of CVE-2026-35273 to attack a large number of sectors, including governments. Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

Hence, the FBI could have easily avoided the hack, but for some reason, Accenture’s contractor failed to install the patch. In June, Oracle also warned, “This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” which would let a hacker install a malicious computer script on a target server. “We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

“We consider implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommend immediate action,” Oracle added. Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

Despite the blunder, the FBI is indicating it’s closing in on the ShinyHunters group, after the agency reportedly nabbed one high-profile leader, named “Rey,” in Jordan, who's also said to be cooperating with authorities. “We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

“We will continue to bring the responsible parties to justice, with multiple arrests already occurring,” the agency’s statement added. “The FBI will aggressively investigate this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters with all available resources.” Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.

Accenture didn’t immediately respond to a request for . On Sept. 15, law enforcement in Europe also arrested another alleged ShinyHunters leader, although this occurred before the group publicly announced the FBI hack. ShinyHunters also walked back its threat to leak the stolen data. Still, there's concern that the gang could have privately sold the information to other groups, including state- cyber spies.