One Missed Patch Exposed the FBI’s Own People
Update, November 12: the net has tightened since this draft was written. A third arrest followed the first two: Canadian cybersecurity executive Edward Dubrovsky was arrested on October 8 and charged with extortion conspiracy. He has not been convicted, and the complaint remains under seal. Reuters now puts the exposed group at more than 5,000 FBI personnel, and reporting says the attackers pivoted from the jobs portal to the bureau’s GovCloud servers and took 2 to 3 terabytes. The FBI has since launched a new recruitment website. None of it changes the lesson below. It sharpens it: the patch was issued, it was not applied, and the bill is still being counted.
The FBI hunts hackers for a living. This week it fired its own contractor because a patch never got applied.
On Monday the bureau removed an Accenture contractor after concluding that a missed security patch opened the door to ShinyHunters, the prolific cybercrime group that has been terrorizing corporate America for years. The attackers walked into the FBI’s job portal and internal HR systems and walked out with the personal data of thousands of bureau employees: home addresses, phone numbers, information on their spouses, their intelligence and surveillance roles, and private medical records.
Read that list again. Intelligence and surveillance roles. Medical records. Of FBI employees. Sitting in the hands of ShinyHunters.
The patch was issued. It just never got applied.
FBI cyber chief Brett Leatherman put it in the plainest possible terms: “the incident occurred as the result of a security failure of a platform managed by a third-party organization, after a contractor failed to implement a security patch explicitly issued to secure the platform.”
Explicitly issued. Not an obscure advisory buried in a vendor portal. A patch the contractor was told to apply, on a platform it was paid to keep patched. And it never happened.
Two sources told Reuters the platform was Oracle PeopleSoft and the third party was Accenture, which handles software patch management and custom code for the bureau. The FBI itself did not name either. Oracle provided the patches, per those sources. They were not integrated.
This is the part that should keep every CISO awake. The FBI had the best threat intelligence in the world, a direct line to every vendor, and a contractor whose entire job was patching. It still lost.
The attackers bypassed the WAF with a URL trick
The technical details make it worse. According to Mandiant, ShinyHunters exploited a bypass for CVE-2026-35273 in PeopleSoft’s Environment Management Hub, the component administrators use to manage and monitor PeopleSoft environments. The trick: URL encoding to slip around a web application firewall rule that was supposed to block the vulnerable endpoint.
Let that sink in. There was a WAF in front of the application. The WAF had a rule for this exact endpoint. The attackers encoded the URL differently and walked straight past it.
A WAF in front of an unpatched application is a speed bump, not a wall. The FBI’s contractor apparently treated it as a substitute for the patch. It was not.
The FBI is arresting ShinyHunters while ShinyHunters holds its data
Three members of the group have already been arrested as the investigation continues, and the FBI says more arrests are likely. There is a certain grim irony in the bureau’s own employees having their psychiatric records stolen by the same crew the bureau is hunting down.
But irony is not the point. The point is the pattern. This is a missed patch on a third-party managed platform holding employee data. Replace “FBI” with any enterprise, “Accenture” with any managed services provider, and “PeopleSoft” with any HR platform, and you have a story that could be written about a thousand organizations this year. The FBI just happens to be the one that made the news.
What CISOs should take from this
Three lessons, and none of them are about buying more tools.
First, your patch SLA with your vendors must be a contract term, not a hope. If a third party manages your platforms, the patch timeline needs to be written down, measured, and tied to consequences. The FBI removed a contractor after the fact. You want to know about the missed patch before the breach, not after.
Second, verify patching independently. “The vendor handles it” is not a control. Ask for evidence: patch reports, scan results, attestation. Trust but verify is a cliche because the alternative is this story.
Third, a WAF is not a patching strategy. It is a layer. The URL encoding bypass here is a textbook case of compensating controls being treated as permanent fixes. Every WAF rule you rely on instead of a patch is a bet that attackers will not find the bypass. They will.
The question for your next board meeting
Ask your team: for every third party that manages a system holding our employee or customer data, who applied the last critical patch, when, and can we prove it? If you cannot answer that in one sentence, you have an FBI-sized problem at enterprise scale.
The bureau had the budget, the mission, and the best hackers on the planet working for it. It lost because one contractor skipped one patch. Your patch program is only as strong as the least accountable person in the chain.
Facts: Reuters reported October 5, 2026 that the FBI removed an Accenture contractor over the breach; FBI cyber chief Brett Leatherman confirmed the contractor failed to implement an explicitly issued security patch; two sources identified Oracle PeopleSoft and Accenture (the FBI named neither); ShinyHunters claimed the September intrusion on the FBI job portal; Mandiant assesses exploitation of a CVE-2026-35273 bypass in PSEMHUB via a URL-encoding trick around a WAF rule; stolen data included addresses, phone numbers, spouse information, intelligence and surveillance roles, and medical records; three ShinyHunters members have been arrested.
About Author
