The FBI has now said that the breach of its FBIJobs.gov recruiting platform came down to a contractor failing to apply an available security patch, and in early October it removed an Accenture contractor over the incident. When I discussed the breach on a recent episode of my CyberSecureOT podcast, the working story was the one the ShinyHunters extortion group told: an unknown Oracle PeopleSoft flaw used against the bureau. The FBI’s account points somewhere more familiar, and for most operators more uncomfortable: security on a platform an organization depends on but does not run itself.
That is third-party cyber risk, and it ties together the stories I covered on that episode. Kiteworks asked customers worldwide to take its secure file-sharing systems offline on the strength of a federal warning. A Queensland government department, the one responsible for the state’s cybersecurity policy, lost $809,000 after attackers illegally accessed an external telecommunications provider’s systems. In each case, the exposure ran through a contractor, a vendor platform, or a service provider rather than the victim’s own core network, another variation on the weaponized basics problem covered earlier in this series.
Industrial operators will recognize the pattern, because our environments depend on integrators, maintenance contractors, remote access providers, file transfer tools, and telecom carriers. You can lock down your own internal network and be disciplined about cyber, but if your suppliers and the vendors they use have weak security, their breach becomes your financial disaster.
Contractor patch failure reframes the FBI breach
ShinyHunters claimed on September 22 that it had compromised FBI systems through a previously unknown PeopleSoft vulnerability in the FBIJobs.gov portal and then moved into FBI-managed servers on AWS GovCloud, BleepingComputer reported. The group said it held data on almost all FBI agents and job applicants, and sample files reviewed by journalists appeared to include home addresses, Social Security numbers, and field office assignments, according to The Register. The group also claimed to have taken 2 to 3 terabytes of data, a figure the FBI has not confirmed.
FBI cybersecurity chief Brett Leatherman later told Nextgov/FCW that the incident resulted from a security failure on a third-party-managed platform, after a contractor “failed to implement a security patch explicitly issued to secure the platform.” A person familiar with the matter told the publication that Accenture handles software patch management at the FBI and that Oracle had supplied the patches that were not applied. The bureau has not named the specific vulnerability, although Google’s Mandiant had separately reported renewed ShinyHunters exploitation of a PeopleSoft flaw that Oracle patched in June. The case fits a broader rise in exploitation of public-facing applications alongside supply chain and identity attacks.
The lesson I drew on the show holds whichever route the attackers took: patch your software and segment your internal networks, because a flat network will destroy you. Moving from a recruiting portal into cloud-hosted personnel records is exactly the kind of lateral path that network segmentation is designed to constrain.
Pressure on the group has since increased. Reuters reported, citing unnamed sources, that a suspected member was detained in Jordan and is assisting investigators, although BleepingComputer reported that a new ShinyHunters leak site appeared days later, which suggests other members remain active.
Kiteworks shutdown tests the limits of precautionary response
On September 25, Kiteworks advised customers to take self-managed systems, on-premises or on AWS or Azure, offline for a nine-hour window in their local time zone, citing credible threat intelligence from federal intelligence authorities. The company shut down the systems it hosts for customers during the same window, said it had no indication of compromise, and lifted the recommendation on September 27.
During the shutdown, Kiteworks identified a previously unknown critical vulnerability in Advanced Forms, a data collection tool it said about 50 organizations use, and deployed a fix, CyberScoop reported. The company said it had no indication the flaw was exploited, that its file transfer and collaboration products were unaffected, and that all known vulnerabilities are addressed in release 9.5.1. It has not identified the federal authority behind the warning or the threat actor involved.
I see the shutdown as a defensible trade. Sometimes the only way to win is to temporarily turn off the battlefield, and a few hours of downtime is far cheaper than a catastrophic breach. Kiteworks has not said whether an attack was actually attempted, though, so no one outside the company can measure what the shutdown prevented. Industrial operators may face the same call with vendor-supplied data exchange or remote access tools: whether to accept a planned outage on a supplier’s warning before any vulnerability is public. It is one of several vendor access risks we already manage.
Queensland loss exposes contract gaps in third-party cyber risk
Queensland’s Department of Customer Services, Open Data and Small and Family Business disclosed in its latest annual report that it lost A$809,000 after a July 2025 cyberattack carried out for financial gain. A department spokesperson said the systems of a third-party telecommunications provider were accessed illegally, that no payment was made to those responsible, and that no government data was compromised, Insurance Business reported. The department has not said how the funds were lost.
The disclosure followed a Queensland Audit Office report, tabled in March 2026, which found that the three public sector entities it audited could not effectively identify and manage their third-party cyber security risks. Only two of 36 contracts reviewed required third parties to report cyber incidents and vulnerabilities, and the auditor found that the department was not actively assessing and monitoring third-party cyber capability across the public sector. The department agreed to the relevant recommendations. These are the gaps that NIST’s SP 1326 supplier due diligence guidance is intended to address.
My conclusion on the show was simple: you must audit your supply chain. Perfect internal security does not protect you from a supplier that cannot tell you it has been compromised.
Consolidation and isolation as architectural responses
The Department of Homeland Security is trying to reduce fragmentation through Network, Cloud and Cybersecurity Services 2.0, a single-award contract with a $626 million ceiling, according to ExecutiveGov, intended to centralize IT service management across network, cloud, and cybersecurity functions. When I recorded the episode, DHS had set October deadlines. In an October 5 notice, it said the schedule was being revised to a later timeframe without new dates, Washington Technology reported. The vehicle sits within wider DHS cyber modernization efforts that have faced cost, staffing, and acquisition hurdles.
If DHS gets its internal networks properly segmented, actively patched, and monitored by a unified team, that benefit trickles down to our national security. The draft solicitation also places Tier 1 and Tier 2 operational staffing for those functions with a single contractor, according to ExecutiveGov.
In my own lab, I am applying isolation to AI. I am running a large language model and a speech-to-text service in Docker containers on an ASUS Ascent GX10, a compact system built on the NVIDIA GB10 Grace Blackwell Superchip that ASUS rates at up to 1 petaflop of AI performance, with no reliance on cloud services. I built it that way because in operational technology, the cloud is a vulnerability. I expect to show what it can do soon.
Supplier patch accountability moves to the foreground
Several questions remain open. The FBI has not identified the PeopleSoft vulnerability involved or explained how it monitored the contractor’s patching, Kiteworks has not published technical details of the Advanced Forms flaw, and DHS has not reset its NCCS 2.0 timeline.
For industrial organizations, everything I covered on this episode comes back to three questions. Are your suppliers patching the systems they run on your behalf? Will they tell you when something goes wrong? And is your network segmented so that their compromise cannot become yours? The Queensland audit’s contract findings show that the answer to the second question can be no even in an organization responsible for setting cyber policy.
You can hear the full discussion on this episode of CyberSecureOT.
