FBI Removes Accenture Contractor After Unpatched PeopleSoft Flaw Exposes Thousands of Employees

What happened?

The FBI removed an Accenture contractor on October 5, 2026, after a missed security patch led to a data breach exposing sensitive personal details of thousands of employees. According to Reuters, two sources identified Oracle’s PeopleSoft human resources platform as the affected system and Accenture as the service provider. FBI cyber chief Brett Leatherman said the bureau’s review found that a contractor failed to install a patch issued to secure a platform managed by a third party. He said the FBI had removed the contractor and taken steps to reduce further risk and protect its workforce.

Key details

• FBI dismissed an Accenture contractor after a missed patch caused a breach of thousands of employee records.
• The breach involved Oracle’s PeopleSoft HR platform, with Accenture acting as the service provider.
• A review found the contractor did not apply a security patch for a third‑party managed system.
• CVE‑2026‑35273 is a critical PeopleSoft flaw that lets attackers execute code without authentication.
• Mandiant observed renewed PeopleSoft attacks on targets that had not installed Oracle’s update.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.