The FBI removed a contractor after a security failure exposed sensitive personal information belonging to thousands of bureau employees, Reuters reported on October 5, 2026. FBI cyber chief Brett Leatherman said the contractor failed to apply an explicitly issued security patch to a platform managed by a third party. The FBI has not publicly named the platform or the contractor’s employer in the statement Reuters quoted.
What happened in the FBI data breach?
Leatherman said the FBI’s review found that the incident resulted from a security failure involving a third-party-managed platform. A contractor had not implemented a security patch that had been explicitly issued to secure it. He said the bureau removed the contractor and took steps to mitigate further risk and protect its workforce. Reuters reproduced the statement in its October 5 report.
As an Amazon Associate I earn from qualifying purchases.
The FBI was still assessing the breach’s ramifications when Reuters published its report. The public details do not establish how the incident unfolded technically or how many records were involved.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat FBI employee information was exposed?
Reuters reported that information about thousands of FBI employees was exposed, including descriptions of named employees’ counterintelligence roles, home addresses of human intelligence operatives, and medical and psychiatric records. The report did not give an exact number of people or records, or a complete inventory of the data.
#1 Best Overall
Was the contractor an Accenture employee?
Reuters cited two people familiar with the matter for the identification of Accenture as the third party involved. The FBI statement quoted by Reuters did not name Accenture or identify the contractor. Reuters said it could not establish the specific contractor’s identity or current employment status.
Accenture told Reuters it was “proud to support the mission of the FBI and will continue to do so,” but did not answer the outlet’s questions about the contractor or alleged patch failure. Reuters also reported that Oracle had not immediately responded to a request for comment.
Was Oracle PeopleSoft involved?
Reuters’ unnamed sources identified the platform as Oracle PeopleSoft. That identification was not included in the FBI cyber chief’s quoted statement, so it should be understood as Reuters’ sourcing rather than an on-record FBI confirmation.
Was a known PeopleSoft vulnerability responsible?
That has not been established. Oracle issued a June 10, 2026 security alert for CVE-2026-35273, affecting supported PeopleSoft PeopleTools versions 8.61 and 8.62. Oracle described the flaw as remotely exploitable without authentication, potentially capable of remote code execution, and assigned it a CVSS 3.1 base score of 9.8. Those advisory details concern the vulnerability; the sources reviewed do not connect it to the FBI incident. See Oracle’s security alert.
Google Threat Intelligence Group and Mandiant separately reported ShinyHunters/UNC6240 exploitation of PeopleSoft between May 27 and June 9, 2026, and a renewed campaign documented on September 25. In the June reporting, they said they notified more than 100 organizations about potentially vulnerable endpoints; 68 percent of those organizations operated in higher education. These figures describe that separate campaign, not FBI victims or the scope of the FBI breach. The reporting does not show that the FBI incident involved the same actors or vulnerability. See the June campaign analysis and the September update.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What PeopleSoft operators can take from the separate advisories
Oracle recommended that affected customers apply security updates without delay. Google and Mandiant’s September reporting warned that string-based web application firewall path rules could be bypassed by URL-encoding a character in a PeopleSoft path, and said such rules are not a substitute for patching.
- Apply Oracle’s security update for affected PeopleSoft systems.
- Reduce exposure of the Environment Management Hub.
- Review logs and systems for indicators of compromise.
- Rotate credentials accessible to PeopleSoft service accounts.
This is general guidance for PeopleSoft operators drawn from the advisories, not a description of the FBI’s remediation steps.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
