Justice Department says North Koreans have infiltrated dozens of U.S. companies

The Justice Department announced Tuesday that North Korean state-sponsored hackers have infiltrated at least 70 U.S. companies by recruiting American facilitators to help them gain employment using stolen identities.

Federal prosecutors indicted and arrested at least two people and conducted searches across more than 40 "laptop farms" in Texas, according to the DOJ. Authorities seized over 180 computers that North Korean operatives had allegedly used to remotely breach American firms and steal sensitive data. The computers had been shipped by victim companies to newly hired employees who were later identified as sanctioned North Korean spies using stolen U.S. citizen identities.

The targeted companies operate in healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states plus Washington, D.C. The DOJ did not name specific companies but said hackers stole approximately $3 million in funds from the breaches.

According to the Justice Department, North Korean IT workers are increasingly "recruiting American facilitators to counter improved private sector detections and law enforcement actions." The scheme relies on fabricated email addresses, spoofed LinkedIn profiles, and fake social media accounts to mask the hackers' identities.

CrowdStrike, which assisted the FBI in disrupting the operations, stated that laptop farms are "vital" to North Korea because they help its hackers overcome physical, financial, and legal barriers to operating inside the United States.

The FBI issued a separate public service announcement stating there are "thousands" of North Korean-state controlled IT workers embedded in Western companies, representing "a significant national security and intellectual property theft insider threat."

This enforcement action represents the latest phase of a broader scheme North Korea has deployed to generate revenue for its internationally sanctioned nuclear weapons program. The regime uses remote IT worker placements to allow North Korean nationals to work for U.S. and European companies, earn wages, and steal sensitive information and intellectual property. Victim companies are then extorted for additional payments.

Experts on North Korea estimate the actual number of compromised companies and stolen data significantly exceeds reported figures. Earlier this year, CrowdStrike reported that North Korean hackers were responsible for roughly half of all documented "hands-on-keyboard" intrusions over the preceding year, referring to breaches carried out by humans rather than automated tools.