The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees, Reuters reported on Tuesday, citing two people familiar with the matter.
The FBI has not publicly named the contractor or the organization involved. However, a senior bureau official told Reuters that its review so far points to a security patch that had not been applied by the contractor responsible for the affected system.
“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in a statement.
“As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” Leatherman added.
According to Reuters’ sources, the system in question is Oracle’s PeopleSoft human resources platform, and the outside organization is Accenture.
ShinyHunters had previously claimed it exploited PeopleSoft to break into the FBI’s job site, and Google recently warned that the threat actor had been targeting vulnerable PeopleSoft instances to steal data.
Accenture did not answer questions about the contractor or the alleged patching failure. Instead, the company said in a statement that it was “proud to support the mission of the FBI and will continue to do so.”