On February 18, 2025, at 4:48 PM Eastern, Sohaib Akhter started recording his termination meeting via Microsoft Teams. HR left after 2 minutes 40 seconds. The recording kept running. By 4:56 PM, his brother Muneeb—whose credentials remained active—logged into Opexus systems and executed 'DROP DATABASE dhsproddb,' deleting a production database for the Department of Homeland Security. Over the next hour, he erased approximately 96 federal databases, downloaded 1,805 EEOC files, and exfiltrated tax data for at least 450 individuals. The entire conversation was captured on that forgotten recording.
The technical architecture failures here are instructive. Opexus, a D.C.-based contractor serving 45+ agencies, had hired the twins despite 2015 wire fraud and computer crime convictions—including a scheme involving a surveillance device at a State Department building. The company's 'extensive background checks' missed these felonies entirely. By the time Opexus scheduled the termination call, Muneeb had already accumulated 5,400 EEOC login credentials and written custom Python scripts (including 'marriott_checker.py') to test them against external systems. His privileges included database deletion rights far beyond any reasonable job function.
Access revocation was the critical failure. Muneeb connected to the VPN 10 minutes before the meeting. His credentials remained active for six minutes after termination—enough time to lock out other users and run destructive commands. Sohaib's access was cut. His brother's was not. That asymmetry, combined with no real-time monitoring for bulk database operations, enabled the attack. At 4:59 PM, Muneeb queried AI systems on clearing SQL Server logs and Windows Server 2012 event logs—queries later entered as evidence.
The brothers discussed blackmail, customer outreach, and extortion for $25,000 each. Muneeb argued against direct contact: 'That's proof of guilt, man.' They settled on plausible deniability. They never considered the recording still running. The transcript captured every tactical decision—cleaning logs, changing DNS records, wiping devices. It removed any ambiguity about intent.
For engineering teams, the lessons are concrete. Background screening must include criminal history verification, not just credit checks. Access revocation should be immediate and system-wide—VPN, RDP, databases, cloud resources—not dependent on manual processes. Least privilege applies to production databases: Muneeb had no business holding DROP permissions across 96 systems. Anomaly detection for bulk deletions outside business hours would have flagged the activity within seconds. Opexus had none.
The case also highlights the human factor. Two experienced hackers with prior records narrated their own crime in real time. They forgot to end a recording they started. That lapse handed prosecutors a verbatim account of method, motive, and cover-up attempts. Technical skill does not guarantee operational caution. Sometimes the simplest mistakes—a forgotten Teams session, an asymmetric revocation, a missed background check—compound into catastrophic failures.
Muneeb signed a plea agreement on April 15, 2026, then attempted to withdraw it via handwritten letters. Sohaib was convicted on May 7, 2026, on multiple counts including conspiracy to commit computer fraud and illegal firearm possession (seven firearms and 370 rounds were recovered from his home). Sentencing is scheduled for September 2026. The case is now studied in security circles as a textbook example of how access control gaps, inadequate monitoring, and human oversight can turn a routine termination into a data engineering nightmare.
Source: Webpronews