Google

Silicon Valley Engineers Indicted for Alleged Trade Secret Theft From Google and Tech Firms

Federal authorities arrested three Silicon Valley engineers on Thursday, charging them with conspiring to steal trade secrets from Google and other tech giants.

The case highlights growing insider threats in the chip design sector, where foreign adversaries could exploit sensitive data on processor security and cryptography.

Samaneh Ghandali, 41, her husband Mohammadjavad Khosravi (aka Mohammad Khosravi), 40, and her sister Soroor Ghandali, 32, all from San Jose, face charges of trade secret theft, attempted theft, and obstruction of Justice.

A grand jury unsealed the indictment on February 19, 2026, after their initial court appearance. If convicted, each could face up to 10 years per theft count and 20 years for obstruction, plus $250,000 fines.

ChargeStatuteMax Penalty per Count
Conspiracy to steal trade secrets18 U.S.C. § 1832(a)(5)10 years prison, $250,000 fine hoyerlawgroup+1
Theft/attempted theft of trade secrets18 U.S.C. § 1832(a)(1),(2),(3),(4)10 years prison, $250,000 fine hoyerlawgroup+1
Obstruction of official proceedings18 U.S.C. § 1512(c)(1)20 years prison, $250,000 fine ​

The trio allegedly exploited job opportunities at top firms handling mobile processor technology. Samaneh and Soroor worked at Google before moving to “Company 3.” Khosravi joined “Company 2.”

They accessed confidential files on processor defenses and encryption, then exfiltrated them to personal devices, each other’s work laptops, and even to Iran.

Exfiltration Tactics and Evasion Moves

Prosecutors detail sneaky methods to dodge detection. At Google, Samaneh sent hundreds of files, including trade secrets, to channels on a third-party messaging app named after the defendants. Soroor did the same.

These files later landed on personal phones, Khosravi’s Company 2 laptop, and Soroor’s Company 3 device.

To cover their tracks, they signed false affidavits denying data sharing, wiped files from devices, and snapped photos of screens instead of downloading full documents.

After Google cut Samaneh’s access in August 2023 due to suspicious activity, she and Khosravi googled data-deletion tips and cell records for the court. They kept photographing Google and Company 2 screens for months.

The night before their December 2023 Iran trip, Samaneh allegedly photographed 24 Company 2 screens on Khosravi’s laptop. In Iran, her device viewed those images, and he accessed more secrets remotely.

According to Justice, this calculated betrayal stole secrets from employers who trusted them, FBI Special Agent Sanjay Virmani said. U.S. Attorney Craig H. Missakian vowed to protect U.S. innovation from those aiding hostile nations.

This case spotlights insider risks in semiconductor security. Processor crypto flaws could enable spying or attacks on devices worldwide.

Firms must tighten exit protocols, monitor lateral data movements, and scan for screen-capture evasion. The FBI, with private partners, probes to safeguard national security tech.

Defendants return to court on February 20, 2026, for counsel assignment before Magistrate Judge Susan van Keulen. They are presumed innocent.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago