Convicted Felons Wiped 96 Federal Databases Minutes After Being Fired — Because a Contractor Left One of Their Accounts Active

Two Convicted Hackers. Forty-Five Federal Clients. Zero Adequate Vetting.

Muneeb and Sohaib Akhter, 34-year-old twin brothers from Alexandria, Virginia, pleaded guilty in 2015 to wire fraud and unauthorized access to State Department computer systems, according to The Register. Muneeb served over three years in prison. Sohaib served two.

Then they both got jobs handling sensitive federal data again.

The Company: Opexus

The unnamed "Company 1" in court documents has been identified by Bloomberg — and confirmed by The Register — as Opexus, a Washington, D.C.-based firm that provides software and services to over 45 federal agencies. Their clients include the Department of Homeland Security and the Equal Employment Opportunity Commission. They also built and maintained FOIAXpress, the federal Freedom of Information Act request portal.

Muneeb joined Opexus in 2023. Sohaib joined a year later. Neither disclosed their prior federal convictions. Somehow, nobody caught it — not during hiring, not during onboarding, not until February 2025.

The Crime Spree Before the Firings

This wasn't a snap decision made in a moment of rage. The brothers had been running criminal operations from inside their trusted positions for months.

According to federal court documents cited by Ars Technica, Muneeb had assembled 5,400 stolen usernames and passwords from his own company's network. He built custom Python scripts — including one called "marriott_checker.py" — to test those credentials against hotel chains, airlines, and DocuSign. He successfully logged in hundreds of times. When victims had airline miles stored, he booked travel for himself.

On February 1, 2025, Muneeb asked Sohaib to query the EEOC's database for a complaint filer's plaintext password. Sohaib did it. Muneeb then accessed that person's private email account without authorization.

That's what finally got them caught.

The 56-Minute Demolition

On February 18, 2025, both brothers were called into a Microsoft Teams meeting and fired. The call ended at 4:50 PM.

Opexus immediately killed Sohaib's VPN access and Windows account. At 4:55 PM, he tried to log back in anyway. Blocked.

Muneeb's account was NOT deactivated. That oversight cost the government dearly.

At 4:56 PM — six minutes after being fired — Muneeb accessed a federal database hosted in Ashburn, Virginia and started deleting. According to Yahoo News and Ars Technica, over the next 56 minutes he:

• Write-protected databases to lock out legitimate administrators
• Deleted 96 databases containing federal government data
• Wiped Department of Homeland Security production data
• Destroyed FOIA records and case management systems
• Stole personal information on approximately 450 individuals from IRS systems
• Copied 1,805 EEOC files to USB drives

When the brothers didn't know specific database deletion commands, they queried an AI tool for instructions on clearing SQL Server and Windows logs — essentially asking artificial intelligence how to destroy forensic evidence, according to The Register. They also physically destroyed evidence on company laptops.

Convicted. Finally.

A federal jury convicted Sohaib Akhter on May 8, 2026, according to Yahoo News. He faces up to 21 years in prison at sentencing scheduled for September 9, 2026. Muneeb awaits his own trial.

FDIC Inspector General Jennifer L. Fain called the attack a "calculated abuse of trust and access" and stated the brothers showed "blatant disregard for the security and integrity of federal information systems," according to Information Age.

Opexus issued a statement to The Register saying they've "taken meaningful steps to strengthen security."

What Mainstream Coverage Is Missing

Most outlets are treating this as a crime story. It is. But they're overlooking the two systemic failures that made it possible.

Failure One: Contractor vetting is inadequate. Two men with federal hacking convictions got jobs handling data for 45 federal agencies. No outlet is asking how this happened — whether background check requirements were bypassed, ignored, or simply insufficient. The government hands out contractor access without adequate scrutiny.

Failure Two: Opexus left one account active during termination. The entire destruction — all 96 databases — happened because Muneeb's credentials weren't killed simultaneously with Sohaib's. Standard security protocol requires revoking ALL access before or during termination. Opexus failed that basic requirement for its federal clients.

Sohaib got convicted. Muneeb is headed to trial. But nobody at Opexus has been named publicly as accountable for either the hiring failures or the credential management failure.

What This Means for You

Your FOIA requests, your EEOC complaints, your DHS records — they were in those 96 databases. The personal information of 450 people was stolen from IRS systems by someone who should have never had access.

The federal government spends hundreds of billions on IT contracts every year. It apparently cannot enforce adequate background checks or implement a basic "revoke all access simultaneously" policy when firing someone.

Two convicted federal system hackers deleted nearly 100 government databases in under an hour.

The real scandal isn't just the brothers. It's that the system let them in — twice.