Opexus: Fired Employees Delete Government Databases Via Microsoft Teams
LΣҒΔ𝕽ΩLL 🇮🇱 reports on a glaring operational security failure involving Muneeb and Sohaib Akhter, two brothers formerly employed by Opexus, a U.S. federal contractor. The brothers were terminated via a Microsoft Teams call after Opexus discovered their criminal records. Critically, their access was not revoked during this termination call. While still connected, they used the active Teams session to record themselves deleting 96 government databases over the course of an hour. The recording captured their conversation, including checks on VPN connectivity and confirmation of deletions.
This incident highlights severe lapses in offboarding procedures and access controls. It’s unfathomable that individuals with a known criminal history gained access to sensitive government environments. Furthermore, the ability for a single user to delete such a large volume of data so rapidly points to a complete absence of effective preventative controls and segregation of duties. This isn’t just an insider threat — it’s a catastrophic failure of basic security hygiene, especially within a federal contractor supporting the U.S. government.
What This Means For You
- If your organization handles sensitive data or works with federal contracts, this is a wake-up call. Immediately review your offboarding procedures. Ensure all access — including VPN, SaaS applications like Teams, and database credentials — is revoked *before or concurrently with* a termination notice. Audit your database access controls: implement least privilege, multi-factor authentication for administrative tasks, and robust logging/alerting for mass deletion events. Don't assume your 'most powerful' clients have their act together; verify your own posture.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.