DOJ Indicts Americans for Helping North Korean Hackers Infiltrate Dozens of U.S. Companies
U.S. citizens allegedly helped North Korean operatives secure remote IT jobs at 70+ companies using stolen identities, with Texas laptop farms masking their locations. DOJ arrested two Americans, searched 40+ sites and seized 180 computers tied to $3M in stolen funds.
The U.S. Department of Justice announced in October 2026 that North Korean hackers have infiltrated at least 70 American companies by posing as remote IT workers, and that U.S. citizens are increasingly being recruited to help facilitate the scheme.
Prosecutors said they indicted and arrested at least two Americans and conducted searches across more than 40 suspected “laptop farms” in Texas. Federal authorities seized over 180 computers that U.S. companies had unknowingly shipped to newly hired employees who were, in fact, sanctioned North Korean operatives using stolen American identities to gain employment.
The affected companies span the healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia. The DOJ said the hackers generated approximately $3 million in stolen funds, though experts suggest the true figure is likely higher. Victim companies were also reportedly extorted into making further payments after being infiltrated.
CrowdStrike, which assisted the FBI in investigating and disrupting the operations, described laptop farms as “vital” to North Korea’s hackers, helping them overcome the physical, financial, and legal barriers of operating outside the United States. The FBI separately warned that “thousands” of North Korean state-controlled IT workers are currently embedded at Western companies, posing what it called “a significant national security and intellectual property theft insider threat.”
The DOJ noted that North Korean operatives typically use convincing email addresses, spoofed LinkedIn profiles, and fabricated social media accounts as cover. American facilitators are increasingly being hired to handle a wider range of tasks, and in some cases entire jobs are subcontracted to third-party foreign nationals.
The remote worker scheme is part of a broader North Korean effort to generate illicit revenue to fund its nuclear weapons program. The regime is also known to target cryptocurrency exchanges and open-source developer projects — and is estimated to have stolen at least $2 billion in crypto during 2025 alone. CrowdStrike has also reported that North Korean hackers were responsible for roughly half of all documented human-operated intrusions over the past year.