The Hacker News reports that the FBI has removed an Accenture contractor for an alleged role in a ShinyHunters breach. The breach led to the theft of personal details of thousands of bureau employees. The stated cause is a patch failure.

Read that sequence again. A criminal extortion group took the personnel data of the agency that investigates criminal extortion groups, and the cause on the record is an update that was available and was not applied.

The account we have identifies the contractor's employer and does not name the system, the vulnerability or the number of days it sat unpatched. Those are the three facts a defender needs to test their own estate, and none of them is in what has been published. What is published is a personnel action.

(A personnel action is the cheapest remediation on the menu. It closes the ticket without touching the process that assigned the ticket to someone.)

The people on the receiving end are the employees. Their personal details, and whatever else the bureau held on them, are now in the hands of a group whose business is selling or leaking what it takes. They cannot rotate a home address.

The same week, our CVE Intel feed shows six flaws from our tracked list added to CISA's Known Exploited Vulnerabilities catalogue in the seven days to 6 October. Each one is a patch that someone, somewhere, is responsible for applying. In most organisations that someone is a contractor operating under a service level written before the flaw existed.

The control that would have changed this outcome sits in the contract, not in the scanner. A patch deadline with a named owner, a weekly report of overdue critical fixes that goes to the client's own security team rather than back through the outsourcer, and a right to read the evidence. The FBI had a contractor to remove. Most organisations have only the contractor.