It Might Be Their Fault, But It’s Your Breach
10-13-2026 (Tuesday)
Hello, and welcome to The Intentional Brief - your weekly video update on the one big thing in cybersecurity for middle market companies, their investors, and executive teams.
I’m your host, Shay Colson, Managing Partner at Intentional Cybersecurity, and you can find us online at intentionalcyber.com.
Today is Tuesday, October 13, 2026, and we’re coming back to another time where everything old is new again - in this case, it’s a large scale breach of sensitive government personnel records, but instead of OMB, it’s the FBI. We’re also having to re-learn that age-old lesson, it might be their fault, but it’s your breach.
It Might Be Their Fault, But It’s Your Breach
In case you haven’t been following the news, this is in reference to a claim made by the hacking group known as ShinyHunters (whom we’ve covered somewhat extensively here on the show before).
At the end of September, they claimed to have breached the Federal Bureau of Investigation’s jobs system and taken a significant number of employee records (in the thousands or even tens of thousands), including “names, home addresses, phone numbers, Social Security numbers, assignments, dates of birth, and details about spouses or other relatives.”
This system in question was running Oracle’s PeopleSoft software, and ShinyHunters has claimed they exploited a flaw that allowed unauthenticated remote code execution. “The group said it then moved into FBI-managed AWS GovCloud systems and downloaded between two and three terabytes of data. Oracle, AWS, and the FBI have not confirmed that attack path.”
It didn’t take long for the FBI to come out swinging, with Cyber Division Assistant Director Brett Leatherman announcing arrests of the members of this group on YouTube, and Reuters reporting that other members of the group have been detained in Jordan and are now actively helping the FBI.
Meanwhile, we’re learning more about the source of the intrusion, which is apparently a missed patch, that an Accenture contractor failed to apply.
Reporting indicates that, again from Cyber Chief Brett Leatherman, who notes “To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI cyber chief Brett Leatherman said in a statement.
Unfortunately for the FBI, as it is for many organizations, it doesn’t really matter that the contractor was the one who failed to do their job, it’s still the FBI’s breach - and it’s impacting FBI employees and their families.
In fact, most organizations aren’t nearly as fortunate as the FBI - who has an enormous amount of both cyber and investigative capabilities at their disposal, arguably more than just about anyone else in the world - who could move to act swiftly to address the attackers.
The rest of us are simply stuck with traditional mop-up duties that include press releases and claims to be better, and maybe an executive change or two if heads really need to roll.
The challenge here is that, even if you’re the FBI, you might be able to outsource the work, in this case to Accenture, but you can’t outsource the responsibility or the risk.
As we talked about last week, attackers are facing only technical challenges, and the rest of us on the defending side have a whole slew of things to account for when we build, run, and protect these information systems, including resourcing and budget and politics and skills and competing priorities and legacy tech and a laundry list of other things.
That’s true for everyone, and yet, we need to do the job of defending the organization to the best of our ability. In this case, one missed patch has caused a raft of pain for thousands of people, much of which may never be publicly known if, for example, adversarial nation-state intelligence agencies were to get their hands not his data.
Most of us aren’t playing with those types of stakes as we patch our systems, but the focus needs to remain just as high. It might not be your responsibility, but, at the end of the day, it’s your risk and it will be your breach when it happens.
Fundraising
From a fundraising perspective, looking at nearly double what we put up last week, at over $28B in newly committed capital, led by:
Disruptive has secured $7.5b for its next fund, which is targeting a total of $10b, per the WSJ.
LS Power raised around $6b for its sixth flagship power and energy infrastructure fund.
Forbion, a Dutch life sciences VC firm, raised a combined €2.3b for its eighth flagship and fourth opportunities funds.
Spectrum Equity Investors tells Axios that it's raised $2.5 billion for its eleventh flagship fund.
A reminder that you can find links to all the articles we covered below, find back issues of these videos and the written transcripts at intentionalcyber.com.
We’ll see you next week for another edition of the Intentional Brief.
Links
https://cybersecuritynews.com/shinyhunters-allegedly-claims-fbi-breach/
https://cybersecuritynews.com/shinyhunters-hacker-helping-fbi/
https://www.fbi.gov/video-repository/shinyhunters-arrested-092926.mp4/view
https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/