Schneier on Security

Clive Robinson • October 12, 2026 12:19 PM

@ ALL,

It’s interesting to note in the article it’s claimed the FBI is blaming a third party.

Further that,

“That contractor worked for Accenture, Reuters earlier reported.”

But then goes on to say,

“The bureau has “removed the contractor and taken all necessary steps to both mitigate any further risk and protect our work force”.

Note they say the contractor not Accenture had been removed…

But also “protect the work force” which any half aware person would know means squat-diddly…

Realistically what can the FBI do, give them a couple of years credit checking?

There are two issues to consider,

1, Any breach of personal or private data by an employers lack of performance, will almost always cause more harm than can be compensated for.

2, The way AI agentic attacks have ramped up means that nearly every employer who has their HR systems directly or indirectly connected to a public network is now in the “lack of performance” category[1].

To be blunt it does not matter if it was Current AI LLM Systems or it was going to be some other way… The speed of gaining unauthorised access to “Confidential Internal use only” systems has been increasing.

And no the solution was never going to be the equivalent of “fire insurance” or similar. Nor is it nabbing those allegedly doing it and putting them in prison.

Because the “risk reward” balance has never really been on the side of Guard Labour.

But another point to consider is that,

3, Data-Brokers almost certainly knew who these employees were before the records were exfiltrated.

Such is the fun of “private surveillance systems where the data is fairly freely available for a moderate price.

[1] Yes for years now I’ve been beating the drum of,

“The “Only way is mitigation by segregation.”

Can people now understand why?