FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

Reuters and follow-up reporting indicate the FBI was breached via a third-party Oracle PeopleSoft platform exploited by the ShinyHunters group (CVE-2026-35273), resulting in theft of personal details of thousands of FBI employees; an Accenture contractor was removed for allegedly failing to apply an explicit security patch and Mandiant assessed the group used a URL-encoding WAF bypass to reach a vulnerable PSEMHUB endpoint, while arrests and further investigation are ongoing.