FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

The FBI has cut ties with an Accenture-supplied contractor after determining that a missed security patch allowed the ShinyHunters group to breach a bureau system and steal personal data on thousands of employees. According to Reuters, FBI cyber division official Brett Leatherman said the incident stemmed from a third-party-managed platform where a required fix was never applied, later confirmed to be Oracle PeopleSoft. Mandiant has linked the intrusion to ShinyHunters abusing a bypass of CVE-2026-35273, using URL encoding to slip past a web application firewall rule meant to shield the vulnerable PSEMHUB endpoint. Accenture says it remains committed to supporting the FBI, while the bureau continues pursuing leads tied to ShinyHunters, a group that has already seen two alleged members arrested.