The short, brutal timeline of this case — two federal contractors sacked in a 4:50 p.m. HR call and one of them allegedly deleting scores of government databases within minutes — exposes a catalogue of basic security failures that should unsettle every IT team that handles sensitive data.
Two 34‑year‑old twin brothers, Muneeb and Sohaib Akhter of Alexandria, Virginia, have been indicted for conspiring to delete government databases after being terminated from a federal contractor role earlier this year. Prosecutors allege that Muneeb deleted roughly 96 databases containing U.S. government information — including Freedom of Information Act (FOIA) records, investigative files and at least one Department of Homeland Security production database — and that the defendants attempted to use an artificial‑intelligence tool to help hide their tracks.
Both brothers have prior federal convictions tied to hacking and data theft, and the indictment charges a mix of computer‑fraud, destruction‑of‑records, identity‑theft, and password‑trafficking counts. If convicted, the defendants face substantial prison exposure under the current filings.
The employer involved is identified in court documents as “Company‑1”; independent reporting and contemporaneous investigative reporting identify the firm as a Washington‑area software and services provider that operates FOIA processing systems used by many federal agencies. According to reporting that reviewed internal and independent forensic analyses, the incident exposed weaknesses in privilege handling, shared credentials and termination workflows.
The indictment alleges one brother's VPN and Windows account were disabled, while the other's session remained active — a classic race condition between HR action and technical revocation.
Operationally, the damage goes beyond criminal justice: agencies that relied on the contractor experienced FOIA processing outages and manual backlogs; at least one vendor’s product that processes FOIA requests was implicated, creating downstream delays for ordinary citizens seeking records. The administrative fallout includes forensic investigations, notification obligations related to personally identifiable information, contract and procurement reviews, and likely regulatory and congressional scrutiny.
The presence of AI in the narrative escalates the problem only insofar as it reduces the time required for a motivated insider to research evasive techniques; it does not absolve the employer of responsibility for architecture and process failures. Teams that act now to automate deprovisioning, adopt PAM and immutable backups, and centralize logs into a hardened detection pipeline will be less likely to make headlines for the wrong reasons.
The broad takeaway for every Windows admin and federal contractor is straightforward: assume insiders can and will try to misuse privileged sessions — design systems so that privilege is temporary, observable and recoverable, and ensure recovery pathways are insulated from the production environment.
The criminal case will proceed through the courts; in the meantime, the operational fix is not novel or costly at scale — it is a disciplined, automated approach to identity, access and recoverability that organizations of all sizes can and should implement immediately.
Source: theregister.com Twin brothers charged with deleting 96 US govt databases
Background
Two 34‑year‑old twin brothers, Muneeb and Sohaib Akhter of Alexandria, Virginia, have been indicted for conspiring to delete government databases after being terminated from a federal contractor role earlier this year. Prosecutors allege that Muneeb deleted roughly 96 databases containing U.S. government information — including Freedom of Information Act (FOIA) records, investigative files and at least one Department of Homeland Security production database — and that the defendants attempted to use an artificial‑intelligence tool to help hide their tracks.Both brothers have prior federal convictions tied to hacking and data theft, and the indictment charges a mix of computer‑fraud, destruction‑of‑records, identity‑theft, and password‑trafficking counts. If convicted, the defendants face substantial prison exposure under the current filings.
The employer involved is identified in court documents as “Company‑1”; independent reporting and contemporaneous investigative reporting identify the firm as a Washington‑area software and services provider that operates FOIA processing systems used by many federal agencies. According to reporting that reviewed internal and independent forensic analyses, the incident exposed weaknesses in privilege handling, shared credentials and termination workflows.
What happened — a clear, minute‑by‑minute picture
- Around 16:50 on February 18, the brothers were terminated during a virtual meeting with HR. One brother’s VPN had been deactivated and his Windows account disabled; the other remained connected to internal systems and, within minutes, issued commands that prevented other users connecting or modifying a targeted database and then deleted it. Prosecutors say the deletion activity rapidly multiplied across many databases.
- Approximately one minute after deleting a Department of Homeland Security production database, the indictment alleges that one of the brothers queried an AI tool: “how do i clear system logs from SQL servers after deleting databases,” and later asked about clearing Windows event and application logs. The brothers are also alleged to have discussed cleaning out their house in anticipation of a law‑enforcement search and to have wiped company laptops before returning them.
- Independent and internal forensic reports reviewed by journalists indicate the incident included both deletion of data and exfiltration: the alleged removal of at least 1,805 files from a government project, and the theft of copies of IRS information and other records affecting hundreds of individuals.
Why this should alarm agencies and contractors
The incident exposes four systemic dangers that recur across enterprise and government environments:- Insider access persistence. Termination processes that fail to cut live access immediately create a high‑risk window. In this case, the gap between HR action and technical enforcement allegedly allowed destructive operations to begin while the termination call was still underway.
- Overly broad privileges and shared secrets. Investigations highlight credential practices and access models that allowed contractors to reach production databases used by multiple agencies. Shared usernames/passwords, insufficient role separation, and lack of robust privileged‑access governance make lateral or destructive actions too easy.
- Fragile backup and retention posture for operational data. The reported deletion of FOIA request records and investigative files shows how business‑critical functions can be disrupted when backup windows, retention policies and rapid recovery capabilities are inadequate. The ability to restore must be architected to survive an insider who can alter or delete primary systems.
- The rise of AI as an opportunistic tool. The alleged one‑minute turn to an AI chat tool for log‑clearing advice is both symbolic and practical: sophisticated machine learning systems can accelerate novice operators’ ability to discover destructive or evasive commands. That doesn’t make AI itself criminal, but it magnifies the consequences of poor controls.
Technical anatomy: how the deletion likely unfolded (high‑level)
This section refrains from sharing instructions that would facilitate wrongdoing. The purpose is to explain the failure modes defenders must harden.Privileged session and live revocation
An active administrative session that retains a valid token, VPN tunnel or elevated Windows session can continue to operate even when a nominal account has been disabled elsewhere. Session tokens or open TCP connections can maintain the ability to issue SQL or OS‑level commands until the session is terminated, unless endpoint or network controls forcibly cut the connection.The indictment alleges one brother's VPN and Windows account were disabled, while the other's session remained active — a classic race condition between HR action and technical revocation.
Database commands, access control and “write protection”
Prosecutors say the defendant issued commands that prevented other users from connecting and making changes, then deleted databases. That pattern is consistent with an attacker first modifying access control or lock states (effectively isolating a database), then invoking destructive database operations. Without immediate, verifiable backups and transaction log archives stored in an immutable or air‑gapped location, point‑in‑time recovery can be impossible or time‑consuming.Logs and forensic evidence
Modern Windows and SQL Server environments generate event logs and transaction logs that are essential for reconstruction. The indictment’s allegation that an AI was queried about clearing logs underscores an attacker’s awareness of logs’ evidentiary value. That risk can be mitigated by forwarding logs to centralized, append‑only collectors or SIEMs that are separate from the systems being attacked, so tampering on a local host cannot erase the only record. Microsoft’s Windows Event Forwarding and centralized collection recommendations are the standard defensive pattern.What went wrong procedurally
Several procedural breakdowns are evident from the published filings and investigative reporting:- Failure to fully vet contractor clearance and revocation: the brothers had prior convictions that later surfaced during a clearance check; the failure to proactively reconcile risk with access appears central to the incident.
- Weak termination processes: termination took place but access revocation lagged, enabling destructive actions inside a live session.
- Shared and mismanaged credentials: reporting indicates insecure credential practices, which increase attack surface and make brute or lateral access easier.
- Insufficient separated backup architecture: destructive deletions across many databases indicate the backups and recovery paths were either not present, not isolated, or not fast enough for operational recovery. Robust backup and transaction log strategies are required for databases in full‑production environments.
Legal and operational consequences
The indictment charges include conspiracy to commit computer fraud and to destroy records, counts of computer fraud, theft of U.S. government records, aggravated identity theft, and password‑trafficking counts. One defendant faces potential mandatory minimums for aggravated identity theft and decades of maximum exposure on combined counts; the other faces multiple years of potential imprisonment under the current filings. The Justice Department framed the case as an abuse of trust by contractors entrusted with sensitive government information.Operationally, the damage goes beyond criminal justice: agencies that relied on the contractor experienced FOIA processing outages and manual backlogs; at least one vendor’s product that processes FOIA requests was implicated, creating downstream delays for ordinary citizens seeking records. The administrative fallout includes forensic investigations, notification obligations related to personally identifiable information, contract and procurement reviews, and likely regulatory and congressional scrutiny.
The AI angle: opportunistic, not magical
The detail that one defendant queried an AI tool after deleting a DHS database and before trying to clear logs is striking. It is a cautionary vignette illustrating that large language models can serve as rapid "how‑to" assistants to someone with destructive intent. But two important cautions are necessary:- The presence of an AI query does not mean the AI engineered the attack. The indictment portrays AI as an instrument used by alleged perpetrators to seek operational advice for covering tracks. The core fault remains access and privilege mismanagement.
- From a compliance perspective, using AI to attempt to hide evidence or facilitate wrongdoing can itself be evidence of intent and adds to obstruction and related criminal exposure. Organizations should update insider‑threat and acceptable‑use policies to recognize AI misuse as a red‑flag behavior.
Practical, immediate hardening steps for contractors and government teams
These are concrete, defensible controls that reduce the probability and impact of insider attacks; they focus on rapid detection, limited blast radius, and resilient recovery.- Immediate access revocation automation
- Implement a single orchestration that deprovisions VPN, SSO, AD accounts, cloud console access, and privileged session brokers simultaneously when HR triggers termination. Avoid manual, sequential steps.
- Adopt privileged access management (PAM) and just‑in‑time elevation
- Use a PAM broker to remove standing administrative credentials. Replace static admin accounts with time‑bound, audited session elevation. Rotate service and shared credentials automatically.
- Centralized, immutable log collection and alerting
- Forward Windows event logs and SQL Server logs to a dedicated SIEM or WEC/WEF (Windows Event Forwarding) collector that stores events in an append‑only, access‑restricted location. This limits an attacker’s ability to erase the only copy of the evidence.
- Isolate and harden backups (air‑gapped or WORM)
- Ensure backups are immutable or stored offsite with limited administrative access. Transaction log backups and frequent snapshotting enable point‑in‑time recovery for databases; recovery plans must be tested regularly. Microsoft’s SQL Server backup and recovery guidance still recommends frequent, protected transaction logging and tested restores.
- Continuous monitoring of anomalous activity and behavior analytics
- Deploy user and entity behavior analytics (UEBA) to catch unusual patterns: bulk deletes, high‑volume downloads, abrupt privilege changes, and off‑hours activity from privileged sessions.
- Harden termination workflows and HR‑IT integration
- Enforce a policy where HR termination triggers a pre‑authorized technical playbook that is executed automatically by the SOC or identity team; maintain a short, auditable window between HR action and technical enforcement.
- Contractor vetting and continuous evaluation
- Expand background checks and implement periodic re‑checks for contractors handling sensitive systems. Use risk‑based vetting for access to production environments and data that affect national security or customer privacy.
- Forensic readiness and rapid response playbooks
- Preposition forensic tools, preserve volatile evidence, and ensure clear chain‑of‑custody procedures to aid investigations and legal compliance. Run tabletop exercises that include insider scenarios and AI‑related misuse to assess decision velocity.
Windows‑ and SQL‑specific monitoring recommendations (defensive, non‑incriminating)
- Forward Windows event logs to a collector using Windows Event Forwarding; configure a baseline and “suspect” subscription so that suspicious endpoints send all channels automatically. This prevents attackers from erasing the only log store local to a compromised host.
- Configure SQL Server backups under a Full recovery model for critical databases and perform transaction log backups at short intervals. Maintain backups in a separate account and storage tier, with strict access controls and audit trails. Test restores frequently to verify backups are usable.
- Centralize and tier audit logs away from the host to prevent erasure through local admin actions. Make copying and ingestion of logs into a SIEM an automated, immediate pipeline with integrity checks.
Organizational governance and procurement implications
This incident should prompt immediate procurement and contract‑management reviews:- Vendors handling FOIA or other public‑facing government services must meet elevated security criteria, including continuous vetting, evidence of effective PAM, immutable backups, and the ability to demonstrate rapid access revocation.
- Federal agencies should codify “insider‑resilience” requirements in contracts and SOWs, including penalties and mandatory reporting for lapses that lead to data loss or service disruption.
- agencies should prioritize least privilege, zero‑trust network segmentation, and periodic audit of contractor entitlements — not only at onboarding but continuously during the engagement. Reporting indicates that a lack of continuous evaluation contributed materially to the risk in this case.
What this means for the public and FOIA users
Many FOIA requesters rely on automated portals and the responsiveness of agencies to process time‑sensitive requests. Loss of FOIA records or prolonged outages undermines government transparency and can delay legitimate investigations, journalistic inquiries, and citizens' ability to access records. The public impact is tangible: interrupted service, re‑submission burdens on requesters and increased administrative cost to reconstruct lost work.Caveats and open questions
- Several reporting threads summarize forensic findings and the indictment; those documents provide strong detail, but some operational specifics — such as the exact content of the deleted files or the full extent of the exfiltrated data — remain under investigative seal or subject to ongoing forensic analysis. Where claims are presented here as fact, they are drawn from the Department of Justice charging documents and investigative reporting that reviewed independent technical reports; any remaining uncertainty is noted.
- While news coverage identifies the contractor in question and the FOIA portal involved, not every allegation has been adjudicated in court. The indictment reflects charges and alleged conduct; guilt or innocence will be resolved through the judicial process. The technical analysis in this article focuses on hardening and prevention rather than opining on unresolved factual disputes.
Final assessment: lessons for the Windows‑centric ops team
This episode is a terse reminder that security is as much organizational and procedural as it is technological. The technology — Windows servers, SQL Server databases, VPNs, privileged accounts — is well understood and has established countermeasures. The recurring failures that permit destructive insider acts are predictable: slow or disjointed termination processes, standing privileged credentials, lack of immutable offsite backups, and inadequate centralized logging.The presence of AI in the narrative escalates the problem only insofar as it reduces the time required for a motivated insider to research evasive techniques; it does not absolve the employer of responsibility for architecture and process failures. Teams that act now to automate deprovisioning, adopt PAM and immutable backups, and centralize logs into a hardened detection pipeline will be less likely to make headlines for the wrong reasons.
The broad takeaway for every Windows admin and federal contractor is straightforward: assume insiders can and will try to misuse privileged sessions — design systems so that privilege is temporary, observable and recoverable, and ensure recovery pathways are insulated from the production environment.
The criminal case will proceed through the courts; in the meantime, the operational fix is not novel or costly at scale — it is a disciplined, automated approach to identity, access and recoverability that organizations of all sizes can and should implement immediately.
Source: theregister.com Twin brothers charged with deleting 96 US govt databases
Last edited:
