There are rookie mistakes, and then there are Olympic-level mistakes. Sohaib and Muneeb Akhtar, twins who worked in human resources for the company Opexus, managed to record themselves planning and executing a scheme of computer sabotage against their former employer — all because one of them forgot to end the recording of a Microsoft Teams call. On February 18, 2025, the company scheduled a meeting with the brothers — already fired by that point — and Sohaib activated the recording at the 4:48 mark of the call. What he failed to calculate was that the recording kept running long after the "official" meeting ended, capturing everything that followed: a conversation between both brothers where they discussed their plans, methods, and motivations with the candor of a notarized confession. The irony is so thick you can almost chew it: two individuals accused of hacking external systems, defeated not by a firewall or a forensic investigator, but by a "Stop Recording" button that nobody pressed.
To understand the full scope of the disaster, you have to contextualize what the Akhtar twins were doing beyond forgetting to close applications. According to the indictment, after being fired from Opexus — a government software company based in Washington D.C. — the brothers accessed the company's internal systems without authorization. This wasn't access born of curiosity or casual spite: the scheme included data manipulation, access to accounts that no longer belonged to them, and allegedly attempts to cause operational damage to the company that had let them go. This type of post-employment retaliation is not new in the cybersecurity world — there is even specific terminology for the "insider threat" phenomenon that persists after employment separation — but the documentary clumsiness with which they executed the plan is, frankly, extraordinary.
What makes this case particularly interesting from a technical and legal angle is the nature of the evidence. Prosecutors didn't need to reconstruct server logs or battle encryption: they had audio. Direct conversation, in the voices of the accused themselves, describing what they had done or planned to do. In terms of chain of custody and admissibility, it is practically every prosecutor's dream. Microsoft Teams, like most enterprise video conferencing platforms, stores recordings in the corporate tenant's cloud or in the organization's configured storage. This means Opexus had full access to the file from the moment the recording ended — or rather, from the moment someone stopped it, which in this case was much, much later than the Akhtars would have wanted.
It's worth pausing here on something this case illustrates with brutal clarity: the cognitive gap that exists between knowing how to hack systems and understanding the operational implications of the tools one uses daily. The twins, if the accusations are correct, had enough technical knowledge to access systems without authorization. But that knowledge coexisted with a monumental blind spot regarding how Teams recordings work in a corporate context. This isn't as rare a contradiction as it might seem — technical specialization is rarely uniform, and there are sophisticated hackers who commit elementary OpSec (operational security) mistakes. The history of cybersecurity is full of capable operators who betrayed themselves through analogous oversights.
The employment angle also deserves attention. Opexus develops software for government agencies, which places this incident in a category of elevated sensitivity. Unauthorized access to the infrastructure of a company that serves the U.S. federal government is not equivalent to hacking the database of a clothing store. The regulatory and national security implications — even though the public details of the case don't suggest that classified information was compromised — add layers of gravity that prosecutors are surely exploiting to the fullest in building their charges.
From any organization's perspective, the case is an involuntary but powerful reminder about access management after employee separation. The attack vector the Akhtars allegedly used — credentials or access that weren't revoked promptly after termination — is one of the most common and preventable in the catalog of insider threats. The digital offboarding protocol should be as rigorous as onboarding, and in many companies it simply isn't. Every active account belonging to a former employee is a door left ajar.
In the final accounting, this case will live in cybersecurity folklore for years — not because of the sophistication of the attack, but precisely because of the opposite. The Akhtar twins likely face serious federal charges, with audio evidence they produced themselves, because they didn't know Teams was still recording. It's the digital equivalent of robbing a bank and leaving your driver's license on the counter. The technology they intended to exploit exposed them; the technology they used every single day sank them.