Reported by 7 outlets

Timeline

1. original reporting

   Accenture Contractor Removed After FBI Data Breach Exposes Thousands of Employees

   gbhackers.com · 7d ago · October 6th, 2026

   On October 5, the Federal Bureau of Investigation (FBI) terminated an Accenture employee’s contract after a security breach exposed sensitive information belonging to thousands of workers, according to Reuters. The incident involved an allegedly unpatched human resources platform, raising concerns about the bureau’s operational security. FBI cyber chief Brett Leatherman confirmed that the contractor failed […] The post Accenture Contractor Removed After FBI Data Breach Exposes Thousands of Employees appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from securityweek.com

   ShinyHunters PeopleSoft Data Theft Campaign Hits 100+ Organizations, Nottingham University Confirms Breach

   securityweek.com · 125d ago · June 11th, 2026

   ShinyHunters claimed 300 compromised PeopleSoft instances across more than 100 organizations, telling BleepingComputer it used a gadget chain of old and zero-day vulnerabilities. The University of Nottingham confirmed 454,600 current and former students were affected. Researcher Michael R found exposed staging infrastructure including MeshCentral agents, credential spray scripts, and ransom note tooling.

3. update from bleepingcomputer.com

   Oracle Mitigates PeopleSoft Zero-Day Exploited in Data Theft Attacks

   bleepingcomputer.com · 124d ago · June 12th, 2026

   Mandiant and Google Threat Intelligence Group confirmed ShinyHunters (UNC6240) exploited the PeopleSoft flaw from May 27 through June 9, 2026, notifying over 100 organizations, 68% in US higher education. Entry was via /PSEMHUB/ endpoints, with MeshCentral staging on 142.11.200[.]186-190 masquerading as Azure via azurenetfiles[.]net, zstd-compressed exfiltration over SSH to 176.120.22[.]24, and extortion notes named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT. Organizations unable to patch were told to disable the Environment Management Hub or block /PSEMHUB/* and /PSIGW/HttpListeningConnector.

4. update from cloud.google.com

   ShinyHunters Renews Mass Exploitation Campaign Targeting Oracle PeopleSoft with WAF Bypass Techniques

   cloud.google.com · 17d ago · September 26th, 2026

   Google Cloud threat intelligence reported that ShinyHunters renewed mass exploitation of Oracle PeopleSoft using WAF bypass techniques, against a backdrop of more than 100 organizations already targeted via CVE-2026-35273. The report confirmed the campaign persisted months after Oracle's June fix.

5. update from bleepingcomputer.com

   ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

   bleepingcomputer.com · 17d ago · September 26th, 2026

   Google's Mandiant and GTIG reported ShinyHunters modified its exploit to bypass WAF rules that block the literal /PSEMHUB/ path by using URL-encoded versions of it, resuming exploitation of unpatched PeopleSoft servers that had relied on WAF mitigation instead of the June security update.

6. update from securityweek.com

   FBI Blames Contractor’s Missed Patch for ShinyHunters Breach

   securityweek.com · 7d ago · October 6th, 2026

   The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees, Reuters reported on Tuesday, citing two people familiar with the matter. The FBI has not publicly named the contractor or the organization involved. However, a senior bureau official told Reuters that its review so far points to a security patch that had not been applied by the contractor responsible for the affected system. “To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in a statement. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” Leatherman added. ShinyHunters had previously claimed it exploited PeopleSoft to break into the FBI’s job site, and Google recently warned that the threat actor had been targeting vulnerable PeopleSoft instances to steal data. Accenture did not answer questions about the contractor or the alleged patching failure. Instead, the company said in a statement that it was “proud to support the mission of the FBI

7. update from malware.news

   FBI removes Accenture contractor after missed security patch led to breach

   malware.news · 7d ago · October 6th, 2026

   The FBI has severed ties with a contractor working for Accenture amid a massive cybercrime intrusion that may have exposed data on thousands of bureau employees, according to a person with knowledge of the matter. Prolific cybercrime group ShinyHunters claimed responsibility for the hack last month. The data stolen contained employees’ addresses, phone numbers and information on their spouses, among other categories. It also revealed sensitive data on employees’ Stolen FBI data reveals employees’ roles in intelligence and surveillance - Nextgov/FCW ”>intelligence and surveillance roles , as well as private medical information. Accenture is responsible for software patch management and maintaining custom code at the FBI, said the person, who spoke on the condition of anonymity because the situation is sensitive. Oracle — whose PeopleSoft platform was the initial access point that ShinyHunters claimed to have exploited — provided the security patches that were not integrated, the person added.

8. update from hackread.com

   The FBI removed a contractor from the assignment after a missed security patch left the bureau’s PeopleSoft jobs portal exposed. # ShinyHunt

   hackread.com · 7d ago · October 6th, 2026

   The FBI removed a contractor from the assignment after a missed security patch left the bureau’s PeopleSoft jobs portal exposed. # ShinyHunt

   via Mastodon https://hackread.com/fbi-removes-accenture-contractor-shinyhunters-data-breach/

9. update from reuters.com

   Accenture is not only still around... they screwed up the FBI's cybersecurity

   reuters.com · 7d ago · October 6th, 2026

   Accenture was a name from the .dot com era. They had QUITE a reputation back then. it's amazing they were in charge of these levers... submitted by /u/WeekendAtMadoffs [link] [comments]

   via reddit r/cybersecurity: Accenture is not only still around...

10. update from reuters.com

    Accenture contractor removed from FBI following damaging data breach, sources say

    reuters.com · 5d ago · October 9th, 2026

    The development comes as the FBI is still trying to ascertain the ramifications of the breach, ​which some former bureau officials have described as a major blow to the organization's operational security." submitted by /u/Dash-Courageous [link] [comments

    via reddit r/cybersecurity: Accenture contractor removed from FBI following damaging data breach, sources say