What Happened to Sohaib Akhter and Muneeb Akhter?

Sohaib Akhter and Muneeb Akhter, twin brothers from Alexandria, Virginia, gained notoriety for a significant cyberattack against the U.S. government in February 2025. Both men were employed as federal contractors by Opexus, a Washington D.C.-based company that provided software services and hosted data for over 45 federal agencies, including the Equal Employment Opportunity Commission (EEOC), the Department of Homeland Security (DHS), and the Internal Revenue Service (IRS).

The incident was triggered on February 18, 2025, when the brothers were terminated from their positions. This dismissal occurred after their employer discovered Sohaib Akhter's previous felony conviction from 2015. The brothers had a prior history of cybercrimes, having pleaded guilty in 2015 to wire fraud and conspiring to hack into the State Department and other federal systems. Muneeb Akhter served three years and three months in prison, while Sohaib Akhter served two years for these earlier offenses. Despite this, Opexus's background checks, which reportedly covered a seven-year period, failed to flag these convictions before their re-hiring in 2023 and 2024.

Immediately following their termination via a remote meeting, the brothers initiated a retaliatory cyberattack. Muneeb Akhter, in particular, was the primary actor in deleting approximately 96 government databases within hours. These databases contained critical U.S. government information, including sensitive investigative files and Freedom of Information Act (FOIA) records, some of which were permanently lost. The brothers also engaged in credential theft, with Sohaib providing Muneeb with a plaintext password from an EEOC complainant, which Muneeb then used to access the individual's email account. They further attempted to cover their tracks by using AI tools to query how to clear system logs and by wiping their company-issued laptops.

The consequences of their actions were severe, impacting numerous federal agencies and disrupting their ability to serve the public. The brothers were arrested in early December 2025 in Alexandria, Virginia, following an indictment on November 13, 2025. On May 7, 2026, a federal jury convicted Sohaib Akhter on charges including conspiracy to commit computer fraud, password trafficking, and possession of a firearm by a prohibited person. He faces a maximum penalty of 21 years in prison, with his sentencing scheduled for September 9, 2026. Muneeb Akhter faces more extensive charges, including conspiracy to commit computer fraud and to destroy records, two counts of computer fraud, theft of U.S. government records, and two counts of aggravated identity theft, carrying a maximum potential sentence of 45 years in prison. The case highlights significant vulnerabilities in federal contractor vetting processes and insider threat mitigation.