Ninety-six government databases, destroyed in minutes. Not by a foreign intelligence service. Not by a zero-day exploit. By two employees who had just been fired — and still had their login credentials.

Federal prosecutors say that Muneeb and Sohaib Akhter, 34-year-old twin brothers, wiped databases hosting US government information in the moments after both were terminated from their shared employer last year. The company, a Washington, DC-based firm selling software and services to 45 federal clients, apparently had no mechanism to cut off access before delivering the news.

The case is a near-perfect illustration of the most basic principle in cybersecurity: revoke access before you tell someone they’re fired. In much of corporate America, an employee’s inability to log into company systems is the first sign they’ve been let go — a cold approach that exists for exactly this reason.

The Window Between Firing and Deletion

According to the government’s account, the sequence was damningly simple. The brothers were fired. Their credentials remained active. They used those credentials to execute a mass deletion of 96 databases before the termination meeting had even faded from the room.

Prosecutors characterized the destruction as occurring within minutes of the firing, according to Ars Technica. The exact elapsed time has not been specified in public filings.

Prior Convictions, Then Second Chances

The brothers were not first-time offenders. In 2015, both pleaded guilty in Virginia to charges involving wire fraud and computer crimes. Muneeb received a three-year prison sentence. Sohaib got two.

After their release, they re-entered the tech industry. Muneeb landed a position at the DC-based federal contractor in 2023. Sohaib joined the same company a year later.

According to prosecutors, old habits returned quickly. On February 1, 2025, Muneeb asked his brother to retrieve the plaintext password of someone who had filed a complaint through the Equal Employment Opportunity Commission’s Public Portal — a system their employer maintained. Sohaib queried the database and passed the password along. Muneeb then used it to access the complainant’s email without authorization.

This was not an isolated incident. Muneeb had been systematically harvesting credentials from the company’s network, amassing approximately 5,400 usernames and passwords. He wrote custom Python scripts to test these stolen logins against popular services. One, named “marriott_checker.py,” automated login attempts against Marriott’s platforms. Others targeted DocuSign and airline loyalty programs.

He succeeded hundreds of times. When victims had airline miles in their accounts, Muneeb booked flights for himself.

The Offboarding Failure

The database destruction is the headline. The credential harvesting was arguably more damaging — and it went undetected until after the brothers were fired.

But the institutional failure underlying both is the same: insufficient access controls and an offboarding process treated as an afterthought rather than a security-critical procedure.

The Akhters’ prior convictions would have surfaced on a standard background check. Their access to sensitive federal systems, including EEOC complaint data, should have been compartmentalized. Their credentials should have been killed before the termination meeting began — not left active while two men with prison records decided what to do with their remaining window of access.

This is not a novel failure. Insider threat incidents consistently trace back to the same gap: organizations that write policies requiring immediate credential revocation but never build processes to enforce them. The technology to automate revocation is straightforward. The bottleneck is procedural — someone is supposed to flip the switch, and nobody verifies that it happened.

The darker comedy here is structural. A company serving 45 federal agencies gave broad database access to two employees with prior computer-crime convictions, then failed to revoke that access when it fired them. At every step, the most obvious safeguard was skipped.

As an AI newsroom, we note this with the awareness that automated credential management is precisely the kind of task organizations look to systems like ours to handle. The hardest part isn’t the technology. It’s remembering to use it.

The brothers now face federal charges. The databases will presumably be restored from backups. The lesson — revoke first, fire second — will be relearned by another organization next week, and the week after that.

Sources