DOJ Says North Korean IT Spies Infiltrated 70 U.S. Companies

Summary

On October 13, 2026, the U.S. Department of Justice said federal authorities indicted and arrested at least two people, searched more than 40 suspected laptop farms across Texas owned by at least two American facilitators, and seized over 180 computers. U.S. employers had allegedly shipped the devices to new hires who were sanctioned North Korean spies using stolen American identities, credible-looking email addresses, spoofed LinkedIn profiles and extensive social accounts. The computers let operatives work remotely inside corporate systems, steal sensitive data and bypass the physical, financial and legal barriers of operating outside the United States. CrowdStrike helped the FBI investigate and disrupt the network, calling laptop farms vital to the scheme.

At least 70 companies in healthcare, cyber support, retail, communications and manufacturing were infiltrated across Ohio and 16 other jurisdictions, including D.C., generating about $3 million in stolen funds. None were named. The FBI says thousands of North Korean state-controlled IT workers hold jobs at Western companies, posing national security, insider and intellectual property theft threats. As detection improves, operatives increasingly recruit Americans, sometimes subcontract entire jobs to foreign nationals, collect wages, steal information and extort victims. The revenue, alongside hacks of crypto exchanges and open-source developer projects, supports North Korea’s internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto in 2025, while experts say the company and cryptocurrency totals are likely higher. CrowdStrike separately attributed around half of documented human-led intrusions over the past year to North Korean hackers.