Two hackers fired from their jobs accidentally recorded themselves committing crimes on Microsoft Teams. The pair, twins, left their video conference connection running after being terminated, capturing footage of their own illegal activity.
The incident exposes a basic operational security failure. When employees are dismissed, companies typically should disable access to collaboration tools immediately. The twins apparently retained access to Teams long enough to continue working, unaware the recording feature remained active. This created a digital record of their actions.
Law enforcement used the accidental footage as evidence. The recording proved decisive in establishing what the hackers actually did after their termination. Rather than covering their tracks or disappearing quietly, they documented themselves committing the very crimes they faced charges for.
The case highlights the gap between technical sophistication and basic tradecraft. These individuals possessed hacking skills yet made an elementary mistake. They failed to verify whether their communications were being recorded. Most people in illicit activity develop habits around checking account status, clearing logs, or disabling recording. The twins skipped this step entirely.
Microsoft Teams records meetings by default when the feature activates. Users can see recording indicators, but oversight happens frequently. Distracted or hurried individuals often miss these warnings. The twins apparently fell into this category.
For companies, the lesson centers on access control and offboarding procedures. Terminated employees should lose access to all collaboration platforms within minutes, not hours. Chat logs, call records, and recorded meetings should be archived separately from active systems. Automated systems can enforce these policies faster than manual processes.
The incident also demonstrates how casual tools designed for legitimate business communication become evidence in criminal investigations. Teams meetings generate timestamped video and audio. This data persists on Microsoft servers and company backups. Once recorded, deletion becomes nearly impossible.
The twins' case closes with a straightforward irony. They tried to commit crimes but created their own prosecution record. The accidental Teams recording eliminated any