Threat Intelligence
US Justice Department: North Korean Hackers Used Fake Identities to Infiltrate Dozens of Companies
The Justice Department says North Korean hackers posed as US workers to access sensitive data at over 70 companies, using 'laptop farms' and stolen identities.
Ross Grant3 min read
The short version
North Korean hackers pretended to be American workers to get jobs at over 70 US companies. They used fake identities and worked remotely, using company laptops to steal money and sensitive data. US authorities have arrested some people and seized computers used in the scheme.
By the numbers
- 70+companies infiltrated by North Korean hackersTechCrunch
- $3 millionestimated funds stolen by hackersTechCrunch
- 180+computers seized from Texas laptop farmsTechCrunch
- 40+laptop farms raided in TexasTechCrunch
- 2people arrested in connection with the schemeTechCrunch
- $2 billioncrypto stolen by North Korea in 2025 (related context)TechCrunch
What happened?
The US Department of Justice says North Korean hackers used stolen US identities to get hired at over 70 American companies. Authorities raided over 40 'laptop farms' in Texas and seized more than 180 computers. At least two people have been arrested. The hackers are believed to have stolen about $3 million and sensitive company data.
How North Korean Hackers Got In
According to TechCrunch (opens in a new tab), the US Department of Justice (DOJ) has warned that North Korean hackers have infiltrated at least 70 American companies. The hackers used stolen identities of US citizens to get hired as remote IT workers. Once inside, they used company-issued laptops to access sensitive data and, in some cases, steal funds.
The DOJ said it has arrested at least two people and raided over 40 so-called "laptop farms" in Texas. These are locations where computers, often provided by US companies, were being used by North Korean operatives. The operation led to the seizure of more than 180 computers.
What Was Stolen and Who Was Affected
The DOJ did not name the affected companies, but said they include firms in healthcare, cyber support, retail, communications, and manufacturing. The companies are based in Ohio and at least 16 other states, plus the District of Columbia. The hackers are believed to have generated around $3 million in stolen funds. In addition to money, the hackers targeted sensitive information and intellectual property. Some victim companies were also extorted for further payments.
The FBI has warned that there are likely thousands of North Korean IT workers at Western companies, posing a significant insider threat to national security and intellectual property.
How the Scheme Worked
North Korean hackers used real-looking email addresses, fake LinkedIn profiles, and other online accounts to pose as legitimate US workers. They often recruited Americans to act as facilitators, helping them bypass company checks and even subcontracting work to others. The hackers would then use the access they gained to steal data or money, sometimes extorting companies after the fact.
CrowdStrike, a cybersecurity firm that assisted the FBI, described these "laptop farms" as vital to North Korea's hacking operations. They help the regime overcome the challenges of not being physically present in the US.
Wider Context and Previous Incidents
This is not the first time North Korea has used remote workers to infiltrate Western companies. The regime has also been linked to major cryptocurrency thefts, with at least $2 billion stolen in 2025 alone. Experts believe the true scale of these operations may be even larger than reported. CrowdStrike has said that North Korean hackers were behind about half of all "hands-on-keyboard" intrusions (attacks carried out by humans, not automated tools) in the past year.
What Companies and Individuals Should Do
Companies should be vigilant when hiring remote workers, especially for IT roles. Verifying identities, monitoring for suspicious activity, and regularly reviewing access rights can help reduce the risk. The FBI's warning highlights the need for strong insider threat detection and response measures.
For individuals, be cautious with your personal information and be aware that identity theft can be used for more than just financial fraud, it can also be a tool for foreign espionage.
What Happens Next
The DOJ's investigation is ongoing, and more arrests or indictments may follow. The public warning is a sign that US authorities are taking the threat seriously, but also that companies need to improve their defences against sophisticated insider attacks.
Claimed vs confirmed
- Confirmed
North Korean hackers infiltrated over 70 US companies using stolen identities.
The DOJ announced this, according to TechCrunch.
- Confirmed
Thousands of North Korean IT workers are working at Western companies.
The FBI made this statement, as reported by TechCrunch.
- Confirmed
North Korean hackers generated $3 million in stolen funds from these infiltrations.
The DOJ provided this estimate, according to TechCrunch.
- Unconfirmed
The true number of hacked companies and stolen crypto is likely higher than reported.
Experts cited by TechCrunch believe the real figures are larger, but there is no official confirmation.
The impact
- Money
- The hackers are believed to have stolen about $3 million. US companies could face further losses if sensitive data is misused. Under US law, companies may be required to notify affected parties and could face regulatory fines if found negligent.
- Reputation
- Companies in healthcare, retail, and other sectors may face trust issues from customers and partners. The visibility of the DOJ's action may prompt more scrutiny of remote hiring practices.
- Customers
- Customers' data and intellectual property may be at risk. Companies should notify affected individuals if personal or sensitive data was involved, as required by law.
Why it matters
This attack shows how foreign hackers can use stolen identities to bypass hiring checks and gain trusted access to sensitive systems. It highlights the risks of remote work and the need for strong identity verification and insider threat detection.
How does it work?
North Korean hackers used stolen US identities to get hired as remote IT workers. They then used company-issued laptops, often from 'laptop farms', to access sensitive data and steal funds. Fake email addresses and LinkedIn profiles helped them appear legitimate.
Key points
- North Korean hackers used stolen US identities to get hired at over 70 companies.
- Authorities seized over 180 computers from 'laptop farms' in Texas.
- At least $3 million was stolen, along with sensitive data and intellectual property.
- The FBI warns thousands of North Korean IT workers may be working at Western companies.
- Strong identity checks and insider threat detection are essential for remote work security.
Sources
TechCrunch
Reference
