FBI traces ShinyHunters breach of employee data to a patch a contractor failed to apply

Brett Leatherman, assistant director of the FBI's cyber division, traced the failure to a single step. The incident "occurred as the result of a security failure of a platform managed by a third-party organization," he said, "after a contractor failed to implement a security patch explicitly issued to secure the platform." ^[3][4] He added: "As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce." ^[5]

By the Bureau's own account, the fix existed before the intrusion ^[4]. The flaw Mandiant links to the group, CVE-2026-35273, already has an identifier and a WAF rule written against it. The new part is the URL encoding that gets requests past that rule ^[8]. That leaves an unpatched PeopleSoft server exposed to the technique if the filter is its only protection on the PSEMHUB endpoint ^[12]. Mandiant's assessment, as reported, describes the group's method in general ^[8]. If the FBI's server was reached the same way, the filter was the control that got bypassed and the patch was the control that was missing ^[14].

The claims rest on different sources. Only the patch failure and the removal come from the FBI on the record ^[4][5]. Reuters supplied both Accenture's involvement and the PeopleSoft identification, and the Accenture link rests on two unnamed sources ^[2][6]. ShinyHunters itself claimed the job portal as its way in ^[7].

On this record, one person paid for the missed patch ^[1][5]. Accenture said it was "proud to support the mission of the FBI and will continue to do so." ^[9] Nothing in the reporting shows the firm losing the account ^[1][9].

The Bureau's case against the group is still producing arrests ^[10][11]. Arrests act on people. Mandiant's finding is about a filter configuration on PeopleSoft servers, and arrests leave that configuration as it was ^[13].