The FBI has cut ties with an Accenture contractor after concluding that a missed security patch let the ShinyHunters group into the bureau’s job portal and internal HR systems. The attackers walked out with personal, medical, and psychiatric records belonging to thousands of FBI employees.
Brett Leatherman, assistant director of the FBI’s cyber division, told Reuters that the review found the incident “occurred as the result of a security failure of a platform managed by a third-party organization,” after a contractor failed to apply a patch issued to secure it. The FBI has “removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”
The FBI did not name the software or the firm. Reuters identified the compromised system as Oracle PeopleSoft, and technical threat intelligence from Google-owned Mandiant corroborates that. The case shows what happens when a WAF and other perimeter controls sit in front of an unpatched application and nobody enforces the vendor’s patching obligations: the controls do very little.
How the exploit worked: a WAF bypass against PeopleSoft
According to Mandiant, the attackers exploited CVE-2026-35273, a vulnerability in the Oracle PeopleSoft human resources platform. They went after the Environment Management Hub (PSEMHUB), a component administrators use to manage and monitor PeopleSoft environments. PSEMHUB has a long record of vulnerabilities, and when it is exposed to the internet or poorly segmented inside a corporate network, it becomes a prime target for remote code execution (RCE) and authentication bypass.
The URL-encoding WAF bypass
The CVE is only half of what interests me here. The other half is how ShinyHunters got past the FBI’s Web Application Firewall. Mandiant’s analysis says the actors used a URL-encoding trick to evade WAF rules written to block malicious traffic to the PSEMHUB endpoint.
Plenty of security teams use a WAF as a virtual patch, filtering known malicious payloads before they reach the vulnerable application. The weak point is that the WAF and the backend server, here the Oracle WebLogic server that runs PeopleSoft, often decode URLs differently. That mismatch is an “asynchronous decoding” gap, and attackers know how to use it.
My best read is that ShinyHunters used double or mixed encoding. An attacker encodes the payload twice, so a directory traversal sequence like ../ (%2e%2e%2f) becomes %252e%252e%252f. The WAF decodes the request once and sees %2e%2e%2f, which matches none of its traversal or RCE patterns, so it lets the request through. The PeopleSoft server then decodes it a second time and gets ../ back. By the time the payload executes, it has already passed the perimeter.
A temporary WAF filter cannot replace a patch that fixes the flaw in the application’s code, and Mandiant’s research makes that plain. Attackers watch public WAF bypass repositories and adapt their tooling to slip past regex-based rules.
The contractor’s patching gap
The other half of this story is a vulnerability management failure by the contractor. Oracle ships Critical Patch Updates for severe flaws, and the time between public disclosure and active exploitation keeps shrinking. In this case the patch existed and the contractor did not apply it.
The FBI has not said why, so what follows is speculation on my part. I see three plausible explanations. The contractor may have marked the patch as applied in its ticketing system with no automated check that it was deployed and that the PeopleSoft services restarted. The FBI’s internal vulnerability scanning team may have flagged the unpatched PSEMHUB instance, with that finding never reaching the contractor responsible for fixing it. Or change management got in the way: patching legacy HR systems often requires extensive downtime and regression testing, and contractors sometimes delay to avoid disrupting operations, which leaves the system open to zero-day or N-day exploits.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Accenture told Reuters it is “proud to support the mission of the FBI and will continue to do so.” It declined to answer questions about the identity of the removed contractor, that person’s current employment status, or any discipline over the patching failure.
Outsourcing IT operations does not outsource the risk. When a contractor skips a patch, the breach and the reputational damage land on the primary organization, here the FBI.
What the exposed data means for national security
The stolen data goes beyond standard personally identifiable information such as names, Social Security numbers, and home addresses. Earlier reporting on ShinyHunters’ claims says the dataset includes the names of staff in sensitive FBI units, along with private medical and psychiatric records. For federal law enforcement and intelligence personnel, that is a severe operational security failure.
Blackmail and coercion risk
Foreign intelligence services and state-sponsored APT groups use the MICE framework (money, ideology, coercion, ego) when they try to recruit insiders. Psychiatric records, a history of substance abuse, or an undisclosed medical condition give a hostile service material for coercion. Picture an FBI agent in counterintelligence or cyber operations with a documented, highly sensitive psychiatric condition that colleagues don’t know about. A foreign service could threaten to expose it unless the agent hands over classified intelligence or access to secure networks.
Spear-phishing and social engineering
Knowing which unit each employee works in makes spear-phishing much easier to aim. ShinyHunters, or the initial access brokers they sell data to, can use that organizational map for business email compromise (BEC) attacks or for custom malware disguised as internal HR communications. And because the breach ran through the job portal and HR platform, the attackers also got a view into the bureau’s internal structure, hiring pipelines, and personnel movements. That is useful to anyone trying to map the agency’s operational capabilities and staffing gaps.
The FBI has confirmed the patching failure but has not publicly validated every claim ShinyHunters made about how much data it took. I read the contractor’s removal and the urgency of the FBI’s mitigation work as a sign that those claims are credible. That is inference, not confirmation.
ShinyHunters after the arrests
This breach is a milestone for ShinyHunters, which has moved from a chaotic data-extortion crew to a more disciplined operation. The group made its name breaching high-profile corporate targets, including Ticketmaster, Change Healthcare, and various telecom giants, usually with stolen credentials or unpatched cloud misconfigurations. Going after a federal law enforcement agency is a step up in ambition.
Why the arrests did not stop the group
The timing is awkward for the FBI. It has been investigating ShinyHunters and recently announced the arrest of two core members. In most cybercriminal ecosystems, arrests like that fracture or dissolve a group. Here the group kept operating.
ShinyHunters appears to run on a decentralized, affiliate-style model. Core developers maintain the infrastructure and exploit tooling, while specialized access brokers and operators carry out the breaches. Two arrests, while a real win for law enforcement, left that capacity intact.
The FBI says more arrests are likely and that it is “actively working with partners to obtain and execute more leads.” Attribution and prosecution stay difficult because these actors use proxy networks, cryptocurrency tumblers, and encrypted channels to hide who they are. Adapting to WAF defenses, exploiting complex enterprise software like PeopleSoft, and continuing to operate despite federal indictments make ShinyHunters one of the more capable data-extortion groups active on the dark web.
What PeopleSoft admins should do now
Patches and perimeter WAFs are not enough for legacy, monolithic applications like PeopleSoft. HR and financial platforms need defense in depth. For PeopleSoft administrators and enterprise security architects, these are the changes I would make first.
1. Keep PSEMHUB off the public internet
PSEMHUB should never be reachable from the public internet. Audit every PeopleSoft instance and confine PSEMHUB and other administrative endpoints to internal, segmented management networks. Put access behind Zero Trust Network Access (ZTNA) that requires device posture checks and multi-factor authentication before a connection is established.
2. Replace regex-only WAF rules
As this bypass showed, encoding tricks defeat regex-based rules. Move to WAFs that use semantic analysis and deep packet inspection and understand the context of a payload instead of matching strings. Configure them to block by default on administrative endpoints, so that only explicitly whitelisted IP ranges, such as internal jump hosts, can reach PSEMHUB.
3. Verify patches automatically
The contractor’s failure points to the need for closed-loop vulnerability management. Connect your vulnerability scanners (Tenable, Qualys) to your IT service management platform (ServiceNow). When a critical patch is deployed, the system should trigger a second, authenticated scan that confirms the vulnerable component, here the specific PSEMHUB library or WebLogic module, was updated and the service restarted.
4. Put patching deadlines in the contract
Contracts with managed service providers and IT contractors need financially binding SLAs for critical vulnerability remediation. For critical and high-severity CVEs, cap mean time to remediate (MTTR) at 48 to 72 hours. Federal and enterprise customers should also keep the right to run unannounced, independent penetration tests on contractor-managed environments to check compliance.
5. Detect post-exploitation behavior
An attacker who bypasses the WAF and gets RCE through a PeopleSoft flaw will try to move laterally and exfiltrate data. Deploy User and Entity Behavior Analytics (UEBA) and SIEM/SOAR platforms to watch for anomalous database queries. If a service account tied to the PeopleSoft HR module suddenly starts running massive SELECT * queries and compressing data at 2:00 AM, the SOAR platform should cut the database connection and isolate the host automatically, before the data leaves the network.
What this breach shows
The FBI’s removal of the contractor shows that even well-funded government agencies can fail at basic IT hygiene. One unpatched vulnerability in a third-party managed system made strong perimeter defenses useless. ShinyHunters did not need a zero-day. It found an unpatched N-day flaw and applied a well-documented WAF bypass technique.
Organizations that run legacy applications need verifiable patching SLAs and zero trust architectures around them. Until they have both, breaches like this one will keep happening.
The FBI’s investigation continues and more arrests may follow, but the exposed medical and psychiatric records cannot be taken back.
