The FBI pulled an Accenture contractor after ShinyHunters walked off with personal information belonging to thousands of bureau employees. The bureau’s own account is blunt. Someone on the vendor side missed a patch. If you run cybersecurity for a shop that issues contractor badges, VPN tokens, and admin rights to people who don’t sit in your building, this is the week that story stopped being hypothetical.

You already know the rest of the pattern. ShinyHunters can ride a vendor endpoint that’s a few CVEs behind and still holds a live session into a system that stores staff records. The attackers inherit the same view your contractor already had. Your threat-protection stack never lights up a brute-force spray against the edge. It sees a legitimate account doing a bulk export.

The vendor session already had the records

Federal agencies love a clean narrative after a theft: isolate the person, cancel the badge, send the briefing. The operational fact underneath is uglier. The contractor had a seat. The seat had data. The patch that would have closed the hole sat in a queue that wasn’t your queue. You can write “must patch within 72 hours” into a statement of work and still have no telemetry that the box was rebuilt. Attestations aren’t evidence.

That’s the part your board will miss if you let this land as an FBI-only embarrassment. Every hospital, utility, and SaaS shop in your peer group has the same shape. A global integrator. A local reseller. A night-shift analyst employed by someone else. They authenticate through your identity provider. They land on a jump host you built. Then they work from a laptop you don’t image, don’t scan, and can’t force through a reboot. When ShinyHunters or the next crew finds the unpatched service on that laptop, incident response starts with a principal you already blessed.

Same week, Unit 42 published Blinder Tunnel, an Iran-nexus campaign against Iraqi critical infrastructure. The lure is a fake Dubai Airports recruitment pitch. The malware talks home through GitHub. Someone you need (a contractor, a hire, a job offer) carries the session. OT staff who’ll ignore a random attachment will open a careers portal. Your cyber security program that only watches anonymous internet noise will grade that traffic as HR.

If you run plants, grids, or water, treat recruiter mail to engineers as a control-plane event. GitHub as C2 means your “developer sites allowed” policy needs an owner, not a default.

Your office suite can skip the macro lecture

While the FBI story traveled, researchers showed that LibreOffice and Apache OpenOffice can execute attacker code the moment a spreadsheet opens. There’s no macro warning. The old training slide, the one where you tell people to click Disable Content, never appears. The catch is Java. If Java support is on, the file can drive the runtime as soon as the user double-clicks. This is still a proof of concept, with no public reports of it in the wild. Assume the gap between a lab demo and a criminal pack is measured in days.

This belongs in the same conversation as the contractor patch. You spent years teaching users to fear macros. You spent years telling procurement that a famous vendor is a safe pair of hands. Both fail the same way: execution happens on a path you already allowed. Security hardening here is unglamorous. Disable Java in those suites unless a named finance or engineering workflow still needs it. Push that as a managed setting, not a wiki page. If a team truly needs Java in a spreadsheet, give them a locked-down jump box and keep the rest of the fleet dumb.

Contractor cybersecurity you can enforce this week

Start with identities, not slogans. Pull a live list of contractor accounts from your directory, VPN, SSO, and privileged groups. Disable anything that hasn’t authenticated in 30 days. For every remaining account, write down the data it can touch. Employee PII, badge photos, HR exports, and anything that would feed a ShinyHunters dump gets a named owner on your side. If you can’t name the owner, cut the access today.

Then demand patch evidence. For every vendor with a path to those stores, require the current OS build, agent version, and last successful patch timestamp, pulled from their management plane or from an agent you control on a jump host they must use. Missed windows pause the account automatically. Put that in the contract and in the IdP policy. Defense in depth for a vendor is a dedicated network zone, a jump host you image, and no direct path from their unmanaged laptop to the system of record.

Turn on threat detection that cares who the user is. Contractor and integrator accounts should have tighter bulk-export thresholds than staff. Alert on new user-agents, new countries, and first-time access to HR or identity admin APIs. Watch their VPN for password spraying even though they’re “known”; stolen contractor creds still show up as a brute-force pattern if you bother to look.

On the document side, disable Java in LibreOffice and OpenOffice now. Block inbound spreadsheets to groups that don’t live in those files. Keep a four-hour incident response drill that assumes the first compromised box is a vendor laptop: revoke tokens, kill VPN, rotate anything that laptop could have cached, then image your jump hosts. Recurring work is a monthly access recertification with the vendor’s delivery manager on the call, plus a quarterly tabletop where legal, procurement, and security argue over who is allowed to leave a hole open. If that meeting is awkward, it’s doing its job.

Sources

• FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
• Blinder Tunnel Campaign Targets Iraqi Infrastructure
• LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings