U.S. authorities say North Korean operatives infiltrated dozens of companies

The Big Picture

U.S. authorities are warning that North Korean operatives have allegedly used remote technology jobs, stolen identities and U.S.-based facilitators to penetrate dozens of American companies.

The Justice Department said Tuesday that it had indicted and arrested at least two people connected to the alleged operation, which prosecutors said involved North Korean IT workers posing as U.S. residents to secure employment at American businesses. The department said the activity affected at least 70 U.S.-based companies in sectors including healthcare, cyber support, retail, communications and manufacturing.

The announcement illustrates a continuing concern for employers that remote hiring can create opportunities for operatives to conceal their locations and identities while gaining access to corporate systems, data and equipment.

What Happened

Federal authorities searched more than 40 suspected laptop farms in Texas, according to the Justice Department. The sites were allegedly used to receive and operate computers that companies had sent to people they believed were newly hired workers.

Authorities seized more than 180 computers, the department said. Prosecutors alleged that the devices had been shipped by U.S. companies to workers who were in fact North Korean operatives using stolen identities belonging to U.S. citizens.

The Justice Department said the alleged scheme extended across Ohio, 16 other states and Washington, D.C. It did not name the companies it said were affected. Prosecutors said the operation generated about $3 million in stolen funds.

According to the department, North Korean IT workers have increasingly recruited American facilitators in response to stronger private-sector detection efforts and law-enforcement action. In some instances, the department said, workers subcontracted entire jobs to foreign nationals in third countries.

Why It Matters

The case underscores the risk that companies face when remote workers can gain access to internal networks, proprietary information and sensitive customer data without ever appearing at a physical office. The alleged use of laptop farms also shows how a physical location inside the United States can help obscure the actual location of a remote worker.

CrowdStrike, which assisted the FBI in investigating and disrupting the operations, said laptop farms are vital to helping North Korean operatives overcome the physical, financial and legal barriers of working from outside the United States.

In a separate public-service announcement, the FBI said thousands of North Korean state-controlled IT workers are employed at Western companies. The bureau described them as a significant insider threat involving national security and intellectual-property theft.

Background

North Korean operatives have been accused of building convincing online identities to get through corporate hiring processes. The Justice Department said such workers use realistic email addresses, spoofed LinkedIn profiles and extensive online and social-media accounts to support their cover identities.

The alleged remote-worker operation is part of a broader effort by North Korea to generate revenue despite international sanctions, according to TechCrunch. The publication reported that the regime is believed to have stolen at least $2 billion in cryptocurrency during 2025, while noting that estimates of both affected companies and stolen crypto may be higher than reported.

Earlier in 2026, CrowdStrike said North Korean hackers accounted for about half of documented hands-on-keyboard intrusions during the prior year, a category referring to attacks carried out by people rather than automated tools or artificial intelligence.

What Happens Next

The Justice Department's announcement did not identify the companies allegedly infiltrated or provide details on all of the individuals under investigation. The arrests, indictments and equipment seizures signal that authorities are focusing not only on overseas operators but also on U.S.-based people accused of helping them establish a domestic presence.

For employers, the case points to the importance of verifying worker identities, reviewing remote-access practices and scrutinizing unusual shipping or location arrangements for company-issued devices. The FBI's warning suggests the agency expects the insider threat to persist across Western businesses.