A fix that existed
According to Nextgov/FCW, the FBI has removed a contractor working under Accenture after personnel data was stolen through an unpatched system. Accenture manages patching and custom code for the bureau, according to the report, and the attackers got in through Oracle’s PeopleSoft platform. Oracle had shipped a fix for the flaw before the intrusion. The FBI says that fix was never installed.
“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization,” Brett Leatherman, the FBI’s cybersecurity chief, said, adding that a contractor had failed to apply a patch issued to secure it. Accenture said only that it remains proud to support the FBI’s mission. The stolen records reportedly included addresses and family details, information on employees’ intelligence and surveillance assignments, and private medical records. The group that claimed the attack says it will not publish the files, and has not said they were deleted.
This was not the first warning. The same report noted that Google’s Mandiant had seen the group return to widespread exploitation of the same PeopleSoft flaw months after Oracle shipped the fix.
A separate case from September shows what happens to records once someone is in. The Pentagon’s personnel data center began notifying more than three million people, 2.76 million of them living, that files containing unencrypted personal information on one of its file-sharing servers had been accessed by unauthorized users. The exposure ran for roughly nine months before a vulnerability in the system was discovered in July.
Outsourced work, retained accountability
Handing patching and application support to a managed service provider is a sensible, widespread arrangement. Specialists keep platforms current at a cost no single department could match. But the arrangement shifts who does the work, not who answers for the result. When records leave, the regulator, the affected people and the press come to the organization whose name is on the system.
The weak point in most of these contracts is not the work itself. It is how the client knows the work was done. Monthly reports from the provider describe what the provider believes it did. They rarely show, system by system, which fixes are missing today and how long each has been outstanding.
Measure from the system, not the report
The evidence that settles this already exists inside the systems. Every enterprise platform can say what version and patch level it is running. The discipline is to collect that directly and compare it with what the vendor has released.
- Track the exposure window. For each system of record, measure the days between a vendor releasing a security fix and that fix running in production. That single number says more about risk than a percentage of patches applied.
- Verify independently. Have the platform’s own inventory, or a separate scanning tool, report patch levels to someone other than the team doing the patching. A provider that marks its own homework will occasionally get it wrong.
- Write it into the contract. Set maximum exposure windows by severity, require evidence drawn from the systems rather than summaries, and give the client the right to check. Escalation should start on the day a deadline is missed, not after an incident.
- Name the internal owner. Someone inside the organization should be accountable for each critical platform’s patch status, with the authority to escalate when the evidence does not match the report.
Some records need more than one lock
Patching closes doors. It does not decide how much is behind each one. The FBI case shows why that matters: addresses, family members, case assignments and medical history held together are far more valuable to a hostile party than any one of them alone. The Pentagon case adds a reminder that sensitive records can sit unencrypted on a file share for months.
In most organizations, personnel and HR systems are where these combinations accumulate, usually because keeping everything in one place was convenient. Encrypting the most sensitive fields, separating them from routine records, and removing copies that nobody needs all limit what a single missed patch can expose.
In our work, the organizations that hold up best under outsourced arrangements are not the ones with the most detailed provider reports. They are the ones that can see, from the systems themselves, how long each known flaw has been left open.
