Accenture contractor removed from FBI following damaging data breach, sources say
The contractor had failed to properly update – or patch – the system they were responsible for.
The hacking group ShinyHunters said on Sept 22 that they had breached the FBI, stealing data on a large number of current and former FBI employees.
WASHINGTON - The US Federal Bureau of Investigation (FBI) removed an Accenture contractor on Oct 5 over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.
In a statement to Reuters, a senior FBI official confirmed that an unidentified contractor had failed to properly update – or patch – the system they were responsible for.
“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organisation – after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in the statement. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”
The FBI did not identify the platform or third-party organisation, but the two sources familiar with the matter said the platform was Oracle’s PeopleSoft, a human resources platform that the hacking group ShinyHunters said it exploited to break into the FBI’s job site last month.
Oracle did not immediately reply to a request for comment.
The sources also said the third-party organisation was Accenture. Reuters could not immediately identify the specific contractor or determine their current employment status.
In a statement, Accenture said it was “proud to support the mission of the FBI and will continue to do so”. It did not answer questions about the contractor or their alleged failure to patch. REUTERS