:

TWIN BROTHERS DESTROY 96 GOV'T DATABASES AFTER FIRING

INDUSTRY DESK2 MIN READ
TUE, MAY 12, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Two brothers with system access deleted 96 government databases within minutes of being terminated from their IT positions. The incident highlights a critical security gap in credential management protocols.

The twins, employed as IT administrators, gained access to and systematically wiped multiple government databases immediately following their termination. Security officials confirmed the deletion of 96 separate databases across various systems before access could be revoked. Investigations revealed the brothers retained active login credentials and administrative privileges even after receiving termination notices. The rapid succession of deletions—accomplished in minutes—suggests premeditation and intimate knowledge of the targeted systems. This incident underscores a fundamental security vulnerability in many organizations: the failure to disable employee credentials before or during the termination process rather than after. Standard IT security protocol mandates revoking access before informing employees of their termination status. Government agencies typically follow a sequence that includes: - Disabling network access - Revoking credentials - Recovering equipment - Documenting access revocation - Only then conducting the termination meeting In this case, credentials remained active, allowing the employees to execute destructive commands on critical systems. Recovery efforts are ongoing, with agencies assessing whether backup systems contain recoverable data. The incident prompted immediate reviews of credential management practices across multiple government departments. Officials are examining other cases where terminated employees retained system access and identifying staff whose credentials have not been properly deactivated. No statement has been released regarding potential charges against the brothers or recovery timelines for affected systems. The case has become a reference point in security training for proper termination procedures and access control management.

■ SOURCES

Ars Technica

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

Canada's Bill C-22 reintroduces broad surveillance authorities that were rejected in previous legislation, according to privacy advocates. The bill grants government agencies expanded data collection capabilities with minimal oversight.

1H AGOSecurity Desk

The UK's Information Commissioner's Office has fined South Staffordshire Water Plc and its parent company £963,900 ($1.3 million) following a cyberattack that exposed personal data of nearly 664,000 customers and employees.

2H AGOIndustry Desk

Signal has rolled out new in-app confirmations and security warnings designed to protect users from phishing and social engineering attacks. The measures aim to prevent fraud by alerting users to suspicious activity.

2H AGOSecurity Desk

CERT has released six CVEs addressing serious security flaws in dnsmasq, a widely-used DNS and DHCP server. The vulnerabilities affect a core networking tool deployed across countless systems.

2H AGOSecurity Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.