Twin brothers wipe 96 government databases minutes after being fired
488 points
• 6 days ago
• Article
Link
Muneeb 和 Sohaib Akhter 是一对双胞胎兄弟，先前因计算机欺诈被判重罪。 2025 年 2 月，他们在一家为政府承包商担任 IT 职位时被解雇。被解雇数分钟内，Muneeb 利用权限撤销的疏漏，系统性删除了 96 个包含美国政府信息的数据库，其中包括 Department of Homeland Security 和 Equal Employment Opportunity Commission 的系统。他还下载了敏感文件，并通过清除系统日志、咨询 AI 工具如何抹去证据等手段试图掩盖痕迹。
两人有长期犯罪史。 2015 年，兄弟俩均对电信欺诈与计算机犯罪认罪，Muneeb 服刑三年，Sohaib 服刑两年。获释后，他们进入总部位于 Washington, DC 的 Opexus 工作，该公司为 45 个联邦客户提供服务。尽管进行了背景调查，但他们的前科要么被遗漏，要么审查不充分。在职期间，Muneeb 从公司网络中窃取了约 5,400 份凭证，借助定制脚本访问包括 Marriott 、 DocuSign 和多家航空服务在内的账户，有时还用受害者的里程为自己预订旅行。
两人在下午 4:50 通过 Microsoft Teams 通话被解雇后，Sohaib 的访问权限被立即撤销，但 Muneeb 的凭证仍然有效。在 4:56 至 17:50 之间，Muneeb 下达了多条破坏性命令，兄弟俩在此期间实时沟通。 Sohaib 煽动并建议删除文件系统、讨论可能的勒索方案，但 Muneeb 认为勒索风险太高而予以拒绝。事后，他们在一名未具名同谋的协助下重装了笔记本的操作系统。
三周后，联邦探员突袭了 Sohaib 的住所，查获了电子设备，并发现 7 支枪支和 370 发弹药——鉴于其前科，这些均属非法持有。两人于 2025 年 12 月被捕并面临多项指控。 Muneeb 于 2026 年 4 月签署认罪协议，承认主要指控；Sohaib 则诉诸审判，最终被判犯有共谋实施计算机欺诈、密码贩运及非法持枪罪，量刑将在九月进行。
Muneeb 此后自狱中提交手写请愿，声称辩护律师失职并试图撤回认罪，称签字系在压力下作出；他还申请自行辩护，但此类请求在联邦法院罕有成功。本案暴露出在解除访问权限和背景筛查流程上的严重失误，Opexus 承认本应采取更严格的审查，并表示负责雇用这对双胞胎的相关员工已不再任职。
Muneeb and Sohaib Akhter, twin brothers with prior felony convictions for computer fraud, were fired from their IT jobs at a government contractor in February 2025. Within minutes of being terminated, Muneeb exploited a lapse in access revocation to systematically delete 96 databases containing US government information, including systems for the Department of Homeland Security and the Equal Employment Opportunity Commission. He also downloaded sensitive files and attempted to cover his tracks by clearing system logs and consulting an AI tool on how to erase evidence.
The brothers had a history of criminal activity. In 2015, both pleaded guilty to wire fraud and computer crimes, with Muneeb serving three years and Sohaib serving two. After their release, they secured positions at Opexus, a Washington, DC-based firm serving 45 federal clients. Despite background checks, their past was either missed or inadequately vetted. During their employment, Muneeb amassed 5,400 stolen credentials from company networks, using custom scripts to access accounts on platforms like Marriott, DocuSign, and airline services, sometimes booking personal travel with victims' miles.
After their firing via Microsoft Teams call at 4:50 pm, Sohaib found his access immediately revoked, but Muneeb's credentials remained active. Between 4:56 pm and 5:50 pm, Muneeb executed destructive commands while the brothers communicated in real time. Sohaib encouraged the destruction, suggesting filesystem deletion and discussing potential blackmail schemes, though Muneeb rejected extortion as too incriminating. They later reinstalled operating systems on their laptops with help from an unnamed co-conspirator.
Federal agents raided Sohaib's home three weeks later, seizing technology equipment and discovering seven firearms and 370 rounds of ammunition, illegal possessions given his prior convictions. Both brothers were arrested in December 2025 and indicted on multiple charges. Muneeb signed a plea deal in April 2026 admitting to the major allegations, while Sohaib went to trial and was found guilty of conspiracy to commit computer fraud, password trafficking, and illegal firearm possession. He awaits sentencing in September.
Muneeb has since filed handwritten petitions from jail claiming ineffective counsel and attempting to withdraw his guilty plea, arguing he was pressured into signing it. He has also requested to represent himself, a move that rarely succeeds in federal court. The case highlights critical failures in both credential management during terminations and background screening processes, with Opexus acknowledging that additional diligence should have been applied and that the individuals responsible for hiring the twins are no longer employed.
431 comments • Comments Link
讨论集中在一起由一对双胞胎兄弟访问敏感政府数据库所引发的安全漏洞事件上，暴露出招聘、凭证管理和数据保护方面的系统性缺陷。一个关键争议是雇主对类似事件的过度反应：许多人主张在员工离职时立即撤销所有访问权限，而另一些人则认为，如果已实施双人控制、哈希密码等恰当的安全措施，立刻切断访问既不人性也不必要。该事件还暴露出更严重的问题：涉事人员能够访问约 5000 个明文密码，且在有犯罪前科的情况下仍被聘用，凸显了技术标准和背景调查方面的严重疏漏，尤其是在处理敏感数据的岗位上。
普遍的观点是以明文存储密码不可原谅，哈希与加盐是不可妥协的最佳实践。该事件亦揭示了像 SOC2 这类合规框架的局限性：它们通常只验证是否遵守了某些政策，却不评估这些政策本身是否足够严格。多位评论者指出，政府机构常年运行过时系统（例如 Windows Server 2012），且未能执行基本的安全卫生措施，部分原因在于官僚惰性与缺乏问责。
讨论还反映出离职流程中安全需求与人道主义关切之间的紧张。一方面有人认为，突然终止访问是防止数据泄露的必要手段；另一方面有人提出更细致的做法，比如分阶段的离职中心，允许在受监控下有限访问以完成过渡任务，但这类方案需要投入且回报不明确，因此少见。个人经历展示了职场中普遍的不信任氛围：员工担心被盗或突然失业，因而不敢在办公桌上留个人物品。
招聘实践亦遭到审查，尤其是有重罪记录的人如何获得关键系统访问权。部分人将责任归咎于限制背景调查的"Ban the Box"法案，另一些人则质疑招聘经理的判断力。讨论还延伸到工具中立性的更广泛议题：人工智能是在助长恶意行为，还是仅仅降低了本就可能的入门门槛。归根结底，该事件是连锁失败的典型：不当招聘、薄弱的访问控制、过时的基础设施与缺乏监督相互叠加，最终导致重大损害。 The discussion centers on a security breach involving twin brothers with access to sensitive government databases, highlighting systemic failures in hiring, credential management, and data protection practices. A key concern is the overcorrection by employers in response to such incidents, with many advocating for immediate revocation of all access upon termination, while others argue this is dehumanizing and unnecessary if proper safeguards like two-person controls and hashed passwords are in place. The fact that the individuals had plaintext access to 5,000 passwords and were hired despite prior criminal convictions underscores serious lapses in both technical standards and background checks, especially for roles handling sensitive data.
There is broad agreement that storing passwords in plaintext is inexcusable and violates basic security principles, with hashing and salting being non-negotiable best practices. The incident also exposed weaknesses in compliance frameworks like SOC2, which verify policy adherence but do not assess the rigor of those policies themselves. Several commenters noted that government agencies often run outdated systems (e.g., Windows Server 2012) and fail to enforce basic security hygiene, partly due to bureaucratic inertia and lack of accountability.
The conversation reflects tension between security and humanity in offboarding processes. While some defend abrupt access termination as necessary to prevent data exfiltration, others propose more nuanced approaches, such as segmented offboarding centers that allow limited, monitored access for transition tasks. However, such solutions require investment without clear ROI, making them rare. Personal anecdotes reveal widespread distrust in workplace environments, with employees avoiding leaving personal items at desks due to fear of theft or sudden job loss.
Hiring practices came under scrutiny, particularly how individuals with felony records gained access to critical systems. Some attributed this to "Ban the Box" laws restricting background checks, while others questioned the competence of hiring managers. The discussion also touched on broader themes of tool neutrality, with debate over whether AI enables malicious behavior or merely lowers the barrier to actions that were already possible. Ultimately, the incident serves as a case study in cascading failures: poor hiring, inadequate access controls, outdated infrastructure, and lack of oversight combined to enable significant damage.