FBI Removes Accenture Contractor After PeopleSoft Employee Data Breach

FBI removed an Accenture contractor on October 5 after a missed PeopleSoft patch that ShinyHunters linked to thousands of exposed employee records.

The FBI removed an Accenture contractor on October 5, 2026, after Cyber Division official Brett Leatherman said a third party failed to apply a required patch and personal data on thousands of employees was exposed. Reuters sources identified an Accenture-managed Oracle PeopleSoft system used for the bureau jobs site, but the FBI has not officially named the company or platform, has not confirmed that internal systems were compromised, and reports differ on whether the impact assessment is still underway or the risk is now mitigated. ShinyHunters claimed a September breach—dated September 22 by SecurityWeek—citing about 2 to 3 terabytes and a sample of roughly 5,000 records; Krebs said more than 5,000 personnel were affected, other outlets say thousands, and Reuters only partially verified samples, including records linked to Director Kash Patel, with some reports also describing medical, psychiatric, and sensitive-duty details. Coverage splits on CVE-2026-35273, a CVSS 9.8 unauthenticated remote-code-execution flaw in PeopleTools 8.61 and 8.62 from a June Oracle advisory: Mandiant and Krebs connect ShinyHunters’ PeopleSoft activity to it, while the FBI has not named a CVE. The bureau said two members were arrested and more arrests were likely; later reports name Dutch police’s September 15 arrest of Pepijn van der Stap and Jordan’s detention of suspected leader Saif Al-din Khader (“Rey”), whom Krebs says is cooperating after an extortion attempt against Boeing spin-off Jeppesen ForeFlight.