U.S. prosecutors say North Korean operatives recruited Americans to help breach U.S. companies, with authorities seizing hundreds of laptops in Texas as part of the investigation.
The Justice Department says North Korean hackers used Americans as remote IT workers to infiltrate dozens of U.S. companies. Authorities seized over 180 laptops in Texas as part of the investigation, with about 70 companies affected and roughly $3 million in stolen funds identified so far. The scheme relies on stolen identities and legitimate work roles to bypass defenses. What you can do now: enable multi-factor authentication, keep software updated, and review who has access to sensitive systems. Investigations continue and more arrests may follow.
For everyday readers, the takeaway is simple: insider risks can start from trusted workers. Strengthen credentials and monitor access closely to protect your own business or workplace.
The U.S. Department of Justice is warning that hackers tied to North Korea have been recruiting Americans to help breach U.S. companies. In a Tuesday update, officials said two individuals have been charged in connection with the case and that investigators have searched dozens of residences in Texas connected to what authorities describe as large laptop-farm operations.
Instead of hacking directly from abroad, the operation reportedly relied on Americans in trusted roles to access company networks, enabling remote intrusions. Investigators seized more than 180 computers that had been shipped to these workers, a step officials say helped the hackers move through networks more easily. CrowdStrike, which assisted in the probe, called laptop farms a key way for North Korea to operate despite geographic and legal hurdles.
The DOJ says roughly 70 U.S.-based companies, spanning healthcare, cyber services, retail, communications and manufacturing, were affected across Ohio and 16 other states, including the District of Columbia. The scheme is described as having generated about $3 million in stolen funds, though officials caution the total could be higher as work continues.
Officials describe the pattern as North Korean operators hiring facilitators in the U.S. to fill roles that provide access to internal networks, sometimes subcontracting portions of the job to others. The FBI has warned that thousands of North Korean IT workers may be employed by Western companies, representing a persistent insider-threat risk for many organizations.
What this means for readers is straightforward: insider risks can come from people who appear to be legitimate staff. The case underscores the importance of strong verification, regular monitoring, and clear reporting channels for suspicious activity within networks.
The authorities haven’t named specific firms, but they describe a pattern of recruiting Americans with credible online identities to gain entry to corporate systems, then using those credentials to move laterally and steal data or funds.
Experts say the emphasis on remote IT workers shows a growing threat vector that can blur the line between legitimate work and illicit access. The Texas operation’s scale, numerous laptop farms and multiple states, highlights a coordinated effort across different sectors.
If you’re an employee at a company handling sensitive information, this is a reminder to strengthen your own security habits. Use multi-factor authentication, keep software updated, and be wary of requests for unusual access or data outside your normal duties. Insider threats aren’t just about one bad actor; they can involve people in regular jobs who unintentionally broaden a breach.
Investigations are ongoing, with more charges possible as authorities map out everyone involved. For individuals and small businesses, practical steps include enabling MFA on all accounts, maintaining current security tools, and reviewing who has access to sensitive information to ensure it’s limited to what’s necessary.
If you run a business with sensitive data, review insider-threat policies and reinforce authentication and access controls.
Authorities report more than 180 computers seized and about 70 companies affected across multiple states, with roughly $3 million in stolen funds identified so far. Investigations are ongoing.
You're reading the quick version.
Read next
Japan cyber alarm: 20+ firms hit as millions of records leak
Japan orders tighter security after a surge of attacks leaks data from millions of customers, with new powers to neutralize threats coming into force.
As threats grow, the agency signals a shift toward external help to defend critical infrastructure and speed incident responses.
German authorities are probing whether a walking robot was programmed or controlled in real time as it targeted a 16-year-old girl in public.
A small accessory that could mute AirTag alarms has been pulled after critics warned it could aid stalking and theft.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
