FBI removes Accenture contractor after breach exposes employee data: Report

The breach reportedly exposed highly sensitive information, including detailed descriptions of some FBI employees' counterintelligence roles, street addresses of human intelligence operatives

The Federal Bureau of Investigation (FBI) has removed an Accenture contractor after a security failure led to a data breach that exposed sensitive personal information of thousands of bureau employees, Reuters reported on Monday.

 

According to the report, the FBI is still assessing the full impact of the breach, which former bureau officials have described as a serious threat to the agency’s operational security.

 

In a statement to Reuters, FBI cyber chief Brett Leatherman said, “Our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organisation — after a contractor failed to implement a security patch explicitly issued to secure the platform.”

 

 

“As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce,” he added.

 

While the FBI has not identified the platform or the third-party organisation involved, sources told Reuters that the platform was Oracle’s PeopleSoft, a human resources software system, and the third-party organisation was Accenture.

 

Accenture said it was “proud to support the mission of the FBI and will continue to do so", Reuters reported.

 

What happened

 

According to the report, the breach is linked to a hacking campaign involving ShinyHunters, a cybercrime group that has targeted organisations using PeopleSoft software.

 

The group said it exploited a vulnerability in PeopleSoft to gain access to the FBI’s job website last month.

 

The breach exposed highly sensitive information, including detailed descriptions of some FBI employees’ counterintelligence roles, street addresses of human intelligence operatives, and medical and psychiatric records of bureau workers.

 

The FBI did not disclose how much data was accessed or whether all the exposed information was taken by hackers.