FBI Removes Contractor After Unpatched System Breach

The FBI removed a contractor from work for the bureau after a security failure involving an uninstalled software patch led to a data breach that exposed personal information belonging to thousands of employees, FBI cyber chief Brett Leatherman said. The bureau is still assessing the full ramifications of the incident. Leatherman said the FBI’s review found that a third-party-managed platform suffered a security failure after the contractor did not apply a patch explicitly issued to secure it. He said the FBI removed the contractor and took steps to mitigate further risk and protect its workforce. The FBI has not named the contractor, the platform or the third-party organization. Two people familiar with the matter identified the platform as Oracle PeopleSoft, a human resources system, and the organization managing it as Accenture. The FBI has not confirmed those identifications. Accenture said it was proud to support the FBI’s mission and would continue to do so, but did not address questions about the contractor or the missed patch. The contractor’s identity and current employment status have not been established.