After Being Fired, Twin Former Hackers Delete 96 US Government Databases

The United States federal government is currently reeling from a cyberattack orchestrated by twins Muneeb Akhter and Sohaib Akhter, who successfully deleted 96 databases containing federal government information. The attack was launched by the brothers immediately after they were terminated from their positions at a contracting company.

In a startling revelation, both individuals are former hackers who were prosecuted in 2015 for offences including website hacking, credit card theft, and attempting to sell personal information on the darknet. Sohaib has also been implicated in previous incidents involving the theft of colleagues’ data while working at the US Department of State, where he allegedly installed hardware to secretly monitor government systems.

Despite their criminal records, both men managed to re-enter the technology industry following their prison sentences. However, rather than abandoning their hacking activities, they allegedly engaged in further cybercrime while employed at their recent firm. Muneeb joined the contractor in 2023, followed by Sohaib a year later.

According to US authorities, the brothers committed several violations during their employment. On 1 February 2025, Muneeb instructed Sohaib to retrieve the plaintext password of an individual who had filed a complaint via the Equal Employment Opportunity Commission (EEOC) public portal. Sohaib queried the EEOC database and provided the password to Muneeb, who then used it to access the victim’s email without authorisation.

Investigations further revealed that Muneeb had harvested approximately 5,400 usernames and passwords from his employer’s internal network. He subsequently developed several Python scripts to test these login combinations against various popular services. One such script, named “marriott_checker.py”, was used to test logins for the Marriott hotel network. Muneeb reportedly gained access to hundreds of accounts, including DocuSign and airline accounts, even using victims’ frequent flyer points for travel.

The company discovered the duo’s criminal history in February 2025. On 18 February, Muneeb and Sohaib, who reside together in Virginia, were summoned to an online meeting via Microsoft Teams, where they were summarily dismissed. The meeting concluded at approximately 16:50; five minutes later, Sohaib attempted to access the company network, though his VPN and Windows accounts had already been blocked.