The US Federal Bureau of Investigation has removed an Accenture contractor following a data breach that exposed sensitive personal information belonging to thousands of bureau employees.
The FBI said its review found that a contractor failed to install a security patch for a platform managed by a third-party organisation. Two people familiar with the incident identified the affected system as Oracle’s PeopleSoft, a human resources platform used for the FBI’s recruitment website.
The breach has exposed highly sensitive information, including descriptions of some employees’ counterintelligence roles, addresses of human intelligence operatives and medical and psychiatric records. The FBI is still assessing the full extent of the damage.
The incident has been linked to the ShinyHunters hacking group, which said it exploited a vulnerability in PeopleSoft to gain access to the FBI’s job site last month. Oracle had issued security fixes for a PeopleSoft vulnerability in June and urged organisations using the software to apply critical patches without delay.
Accenture confirmed that it would continue supporting the FBI but did not address questions about the contractor or the failure to apply the patch.
The FBI said it has taken steps to contain further risks and protect its workforce as investigators continue to determine how much information was accessed and what longer-term security consequences the breach could create.
Leave a comment