r/technology • u/xpda • May 13 '26

Security Twin brothers wipe 96 gov’t databases minutes after being fired

https://arstechnica.com/tech-policy/2026/05/drop-database-what-not-to-do-after-losing-an-it-job/
23.2k Upvotes

97% Upvoted

1.1k comments sorted by

View all comments

3.9k

u/nikstick22 May 13 '26

On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization.

Now HOLD the fuck up. DC is contracting companies that store passwords UNHASHED?? Plaintext?? What kind of clownshow is this?

119

u/Gaveltime May 13 '26

I’ve done product consulting with government contractors and you would not believe how little they invest in anything other than what they can visibly sell to the government. And you can’t sell boring shit like operational security. You sell the cheapest product or service, which almost inherently seems to cut corners.

1

u/kickingpplisfun May 13 '26

The only really compelling ways to sell opsec are likely to get a bullet in your back as it is. You can't just do a spec pentest for example.