Loading story…
Twin brothers Muneeb and Sohaib Akhter, both former federal contractors, were arrested in Alexandria, Virginia, for allegedly conspiring to destroy and steal sensitive government data after being terminated from their positions. According to court documents, the brothers accessed computers without authorization, deleted approximately 96 databases containing U.S. government information—including records related to the Freedom of Information Act and sensitive investigative files—and attempted to cover their tracks by wiping company laptops and seeking advice from an AI tool on clearing system logs. The indictment also alleges theft of IRS data and unauthorized access to Equal Employment Opportunity Commission information, affecting at least 450 individuals.
The attack targeted a government contractor, reportedly Opexus, which provides services to over 45 federal agencies, including the Department of Homeland Security, IRS, and EEOC. The Akhter brothers, who have a prior history of hacking and wire fraud convictions from 2015, allegedly carried out the data destruction and theft in a weeklong spree in February, immediately following their dismissal. The investigation involved more than 20 federal agencies and specialized units, highlighting the significant impact and scope of the insider breach.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced that Muneeb and Sohaib Akhter were charged and arrested in Alexandria, Virginia, over the alleged insider breach at Opexus. The case was filed in the U.S. District Court for the Eastern District of Virginia and investigated by the FDIC OIG, DHS OIG, and Homeland Security Investigations.
According to later reporting, Mandiant's investigation found that Muneeb Akhter continued deleting databases and exfiltrating files during and after the HR termination meeting. The findings helped detail the scope and timing of the insider attack.
After the alleged deletions, Muneeb Akhter reportedly used an AI tool to ask how to clear SQL Server and Windows Server logs, while the brothers allegedly wiped laptops and discussed preparing for possible law enforcement searches. Prosecutors also accuse Sohaib Akhter of trafficking in a password that could access a government-connected Opexus computer.
During a weeklong period in February 2025, prosecutors allege Muneeb Akhter deleted about 96 databases hosted by Opexus for more than 45 U.S. agencies and stole sensitive EEOC and IRS data, including IRS-related information affecting about 450 people. The impacted data included FOIA-related records and sensitive investigative files, and some records were reportedly permanently lost.
On February 18, 2025, federal contractor Opexus terminated Muneeb Akhter's employment. Prosecutors say the alleged destructive activity began after the firing while access to company systems still existed.
In 2015, Muneeb and Sohaib Akhter pleaded guilty to hacking-related crimes tied to unauthorized access to U.S. government systems, including State Department-related offenses. They later served prison sentences before being rehired as contractors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcedatabreaches.net
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Federal prosecutors in Virginia have filed a superseding indictment accusing brothers **Muneeb Akhter** and **Sohaib Akhter** of a new wave of cybercrime after their termination from a government contractor in February 2025. The indictment alleges the pair conspired to access company and customer systems without authorization, delete about **96 databases** containing U.S. government information, steal sensitive data tied to agencies including **DHS**, **EEOC**, and the **IRS**, and use anti-forensic techniques to destroy evidence. Prosecutors say Muneeb Akhter copied EEOC files to a USB drive, deleted DHS-hosted data, stole IRS-related records containing federal tax information and FOIA materials, and used AI tools to obtain commands for deleting databases and clearing logs. The filing further alleges Muneeb Akhter used roughly **5,400** stolen usernames and passwords from the EEOC Public Portal to access victims’ email, airline, hotel, and financial accounts, including through Python scripts and deceptive domains such as `wardensys.com` and `wardensystems.com`. Sohaib Akhter is separately charged with password trafficking, firearm possession as a prohibited person, and witness tampering tied to the grand jury investigation. The new case follows the brothers’ earlier federal convictions and 2015 sentencing for wire fraud and cyber intrusions involving a private company and the **U.S. Department of State**, where prosecutors said they stole payment-card and personal data, abused insider access to sensitive information, and attempted to establish clandestine access inside a State Department facility.
Jun 29, 2026
A federal jury convicted Virginia resident **Sohaib Akhter** for his role in a retaliatory intrusion that wiped **96 government databases** after he and his twin brother were fired from a Washington, D.C.-area software contractor supporting more than **45 U.S. federal agencies**. Prosecutors said the brothers accessed systems without authorization, write-protected and deleted databases, stole credentials, and tried to destroy evidence; the case also involved trafficking a password tied to an individual who had filed a discrimination complaint with the **Equal Employment Opportunity Commission**. Akhter was convicted of conspiracy to commit computer fraud, password trafficking, and firearm possession by a prohibited person. Court filings and reporting say the brothers also wiped company laptops, discussed preparing for a law-enforcement search, and sought ways to clear system logs after deleting a **Department of Homeland Security** database. The case drew added scrutiny because both men had previously been convicted in an earlier federal computer intrusion case involving **State Department** systems and personal data, yet were later rehired as government contractors. Sohaib Akhter faces sentencing on **September 9, 2026**, with a maximum penalty of **21 years** in prison, while his brother **Muneeb Akhter** separately faces multiple computer fraud, identity theft, and government records theft charges carrying up to **45 years**.
Jun 29, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026