Opexus: Fired Employees Delete Government Databases Via Microsoft Teams

Opexus: Fired Employees Delete Government Databases Via Microsoft Teams

LΣҒΔ𝕽ΩLL 🇮🇱 reports on a glaring operational security failure involving Muneeb and Sohaib Akhter, two brothers formerly employed by Opexus, a U.S. federal contractor. The brothers were terminated via a Microsoft Teams call after Opexus discovered their criminal records. Critically, their access was not revoked during this termination call. While still connected, they used the active Teams session to record themselves deleting 96 government databases over the course of an hour. The recording captured their conversation, including checks on VPN connectivity and confirmation of deletions.

This incident highlights severe lapses in offboarding procedures and access controls. It’s unfathomable that individuals with a known criminal history gained access to sensitive government environments. Furthermore, the ability for a single user to delete such a large volume of data so rapidly points to a complete absence of effective preventative controls and segregation of duties. This isn’t just an insider threat — it’s a catastrophic failure of basic security hygiene, especially within a federal contractor supporting the U.S. government.

What This Means For You

  • If your organization handles sensitive data or works with federal contracts, this is a wake-up call. Immediately review your offboarding procedures. Ensure all access — including VPN, SaaS applications like Teams, and database credentials — is revoked *before or concurrently with* a termination notice. Audit your database access controls: implement least privilege, multi-factor authentication for administrative tasks, and robust logging/alerting for mass deletion events. Don't assume your 'most powerful' clients have their act together; verify your own posture.

🛡️ Detection Rules

3 rules · 6 SIEM formats

3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.

critical T1485 Impact

Opexus Data Destruction via Microsoft Teams

Sigma YAML — free preview

Source: Shimi's Cyber World · License & reuse

✓ Sigma · Splunk SPL Sentinel KQL Elastic QRadar AQL Wazuh Get rules for your SIEM →
Take action on this incident
📡 Monitor opexus.com Free · 1 watchlist slot · instant alerts on new breaches 🔍 Threat intel on Opexus All breaches, IOCs & vendor exposure