One twin pleads guilty, other convicted after alleged deletion of 96 government databases
Summary
Prosecutors said Muneeb Akhter used an overlooked account to delete about 96 US government databases after he and his brother were fired. Muneeb pleaded guilty to major allegations, while Sohaib was convicted of conspiracy and other charges.
Key points
- The government said Muneeb Akhter retained access after the brothers were fired in February 2025 and deleted about 96 databases containing US government information; Sohaib's attempt to access the network was blocked.
- Prosecutors said Muneeb downloaded 1,805 files belonging to the EEOC and obtained federal tax information for at least 450 people.
- The government alleged the brothers had also misused a password obtained from an EEOC database to access a complainant's email account without authorization.
- Prosecutors said Muneeb had collected 5,400 usernames and passwords and used custom scripts to test them on websites, gaining access to accounts including DocuSign and airline accounts.
- The government said Muneeb tried to clear server and Windows logs after deleting databases. The brothers later reinstalled their corporate laptops' operating systems.
- Muneeb pleaded guilty to major allegations in April 2026, then filed letters challenging his plea and asserting his innocence. A jury found Sohaib guilty of conspiracy to commit computer fraud, password trafficking, and firearm possession in May 2026.
Article Details
- Victim Organization
- Opexus and US government agencies, including the Equal Employment Opportunity Commission (EEOC) and the Department of Homeland Security (DHS)
- Incident Type
- Insider sabotage involving deletion of government databases, unauthorized access, and data theft
- Incident Date
- 2025-02-18
- Data Types Exposed
- EEOC files
- Federal tax information
- Usernames and passwords
- Email account credentials
- Affected Records
- About 96 databases were deleted; 1,805 EEOC files were downloaded; federal tax information for at least 450 people was accessed.
- Operational Impact
- Muneeb Akhter deleted about 96 databases containing US government information. The article says the databases had daily backups but does not report whether or how they were restored. The brothers also reinstalled the operating systems on their corporate laptops.
- Ransom Or Extortion
- The brothers discussed possible blackmail but the article reports no extortion attempt. Muneeb rejected the idea during their conversation.
- Claim Status
- confirmed
MITRE ATT&CK
T1052.001 · Exfiltration over USBMuneeb downloaded 1,805 EEOC files and stored them on a USB drive.T1059.006 · PythonMuneeb built custom Python scripts to automate login attempts.T1070.001 · Clear Windows Event LogsAfter deleting databases, Muneeb asked how to clear Windows event and application logs; the article reports that event logs were wiped.T1078 · Valid AccountsSohaib provided a complainant's password, which was then used to access that person's email account without authorization.T1110.004 · Credential StuffingMuneeb used custom Python scripts to test thousands of collected username-and-password pairs against common websites.T1485 · Data DestructionMuneeb Akhter deleted about 96 government databases.
Threat Actors
Muneeb AkhterThe government attributed the database deletions, data downloads, and other unauthorized activity to Muneeb. He signed a plea deal admitting to major allegations in the indictment, though he later challenged his plea and asserted his innocence.Sohaib AkhterThe government said Sohaib supplied a complainant's password used for unauthorized email access and participated in the events surrounding the database deletions. A jury found him guilty of conspiracy to commit computer fraud and password trafficking, among other charges.
Vendors
Products
DocuSignMuneeb managed to log in successfully hundreds of times, including to DocuSign and airline accounts.Microsoft TeamsOn February 18, 2025, the brothers—who lived together in Virginia—were both called into a Microsoft Teams meeting and summarily fired.Windows Server 2012At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?”