Prosecutors say North Korean remote workers got into at least 70 US companies
The Justice Department searched more than 40 Texas laptop farms serving North Korean IT workers and seized over 180 company-shipped computers. Prosecutors count at least 70 victim companies. For employers, the shipping address is now a control point.
The Engineer · Build desk
Key figures: more than 180 computers seized that US companies had sent to new workers; more than 40 laptop farms searched in Texas; the farms belonged to at least 2 American intermediaries, per the Justice Department.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Computers seized that US companies sent, more than | 180 computers | 3 | |
| Farms searched, over | 40 laptop farms | 2 | |
| US farm owners, at least | 2 intermediaries | 6 |
What happened
- The Justice Department said on Tuesday that prosecutors had filed charges and arrested at least two people.
- The farms belonged to at least two American intermediaries, according to the department.
- The department called the searches the largest publicly known operation of its kind by number of homes and residences used.
- Victims worked in healthcare, cyber support, retail, communications and manufacturing, in Ohio and 16 other states including the District of Columbia.
Why it matters
- exposure The victims did not know when they shipped the machines and have not been named. An employer cannot tell from the announcement whether it is among them.
- constraint Checks keyed to an applicant's location or nationality stop working where this pattern starts, because a US intermediary passes them.
- cost A verified device activation adds time to every remote hire. Roles with access to sensitive data are where it pays first.
According to mezha.net, relaying TechCrunch's reporting [16], authorities believe the seized computers were sent by US companies to new hires who turned out to be sanctioned North Korean operatives [3]. The Justice Department said the machines were used for remote access to those companies and to steal sensitive data [5]. CrowdStrike, which helped the FBI investigate recent North Korean operations, said laptop farms are vital for getting around the physical, financial and legal obstacles the hackers face from not being in the US [8].
The operatives got their jobs with stolen American personal data [4]. In our view, that leaves every onboarding record looking like a normal hire: the documents point to a real American, and the delivery address is a US home.
Each site is small. More than 180 computers across more than 40 searched farms [c2, c3] works out to about 4.5 machines per site [17]. Prosecutors say the workers got into at least 70 companies [9] and are believed to have collected about $3 million in stolen funds [10]. That is an average near $43,000 per company [18]. Both inputs are floors or estimates, so treat the average as rough. The report does not say how many of the 70 ran through the Texas sites.
The count of 70 comes from one case. The FBI, in a separate public notice, said thousands of state-controlled North Korean IT workers are employed at Western companies [15].
The Justice Department also described how the scheme is adapting. Workers increasingly use American intermediaries to counter better detection by private companies and law enforcement [13]. They hand those intermediaries a wider range of tasks, and in some cases subcontract whole projects to foreign nationals from third countries [14].
The tightening we'd expect binds the device to the person at a step an intermediary cannot do for them. That means a live-verified first activation, with the machine's network location checked against the address on file. This is our inference from how the scheme works, not Justice Department guidance.
What to watch
- Whether the Justice Department or the companies name the victims, and how many of the 70 trace to the Texas sites.
- Charging documents or pleas in the two prosecutions that show which onboarding checks the victims ran and where they failed.
- Any hiring or device-shipping guidance from the FBI or the Justice Department aimed at employers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On Tuesday the US Justice Department said prosecutors had filed charges and arrested at least 2 people.
- [2]
The Justice Department said authorities searched more than 40 so-called laptop farms in Texas.
- [3]
Authorities seized more than 180 computers that, in their view, US companies had sent to new workers who were sanctioned North Korean spies, unknown to the companies.
- [4]
The North Korean operatives obtained the jobs using stolen American personal data.
- [5]
According to the Justice Department, the computers were used for remote access to US companies and to steal sensitive data.
- [6]
The laptop farms belonged to at least 2 American intermediaries.
- [7]
The Justice Department called the searches the largest publicly known operation by number of homes and residences used to facilitate North Korean hacking.
- [8]
CrowdStrike, which helped the FBI investigate and stop recent North Korean operations, said laptop farms are vital for North Korean hackers to overcome the physical, financial and legal obstacles tied to their absence from the US.
- [9]
Prosecutors said the hackers infiltrated at least 70 US companies.
- [10]
The hackers are believed to have received about $3 million in stolen funds.
- [11]
The Justice Department did not name the victim companies.
- [12]
The victim companies worked in healthcare, cyber support, retail, communications and manufacturing, in Ohio and 16 other states, including the District of Columbia.
- [13]
The Justice Department said North Korean IT workers increasingly use American intermediaries to counter more effective detection by the private sector and law enforcement.
- [14]
The Justice Department said the workers hire intermediaries for a wider range of tasks and in some cases subcontract entire projects to foreign nationals from third countries.
- [15]
In a separate public notice the FBI said thousands of North Korean state-controlled IT workers are employed at Western companies and pose a significant insider threat to national security and intellectual property.
- [16]
The mezha.net article is a report based on TechCrunch's reporting.
- [17]
More than 180 computers across more than 40 searched farms is roughly 4.5 computers per site, using the floor figures.
- [18]
About $3 million across at least 70 companies averages roughly $43,000 per company.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- mezha.netМін’юст США заявляє, що північнокорейці проникли в десятки американських компаній
1 article · October 13, 2026
- techcrunch.comJustice Department says North Koreans have infiltrated dozens of U.S. companies
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Cybercrime EnforcementFollow
- Insider ThreatFollow
- North Korean IT worker schemesFollow