The Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.
The development comes as the FBI is still trying to ascertain the ramifications of the breach, which some former bureau officials have described as a major blow to the organization’s operational security.
In a statement to Reuters, a senior FBI official confirmed that an unidentified contractor had failed to properly update — or patch — the system they were responsible for.
“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in the statement. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”
The FBI did not identify the platform or third-party organization, but the two sources familiar with the matter said the platform was Oracle’s (ORCL.N), PeopleSoft, a human resources platform that the hacking group ShinyHunters said it exploited to break into the FBI’s job site last month.
Oracle did not immediately reply to a request for comment.
The sources also said the third-party organization was Accenture (ACN.N). Reuters could not immediately identify the specific contractor or determine their current employment status.
In a statement, Accenture said it was “proud to support the mission of the FBI and will continue to do so.” It did not answer questions about the contractor or their alleged failure to patch.
