US charges 14 over North Korean IT workers at 70+ firms

The US Justice Department charged 14 people on October 13, 2026 over schemes that placed North Korean IT workers in remote jobs at more than 70 US companies. Officials say the workers used stolen or fake identities and earned about $3 million, which went to accounts controlled by North Korea. For any company that hires remote engineers, the case is a warning that the person on the video call may not be who they claim.

What the Justice Department announced

The department's announcement lists the actions:

Action	Detail
Companies affected	More than 70, in Ohio, 16 other states and Washington, DC
People charged	14: two people in the US, ten based in China and two under seal
Arrests	Two: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas
Searches	More than 40 homes in Texas, from September 21 to 25
Devices seized	About 187 computers and related devices
Revenue	About $3 million

The outlets describe the numbers slightly differently. TechCrunch counts over 180 computers seized, and the FBI described "nearly 190 devices." The charges are allegations, and the defendants are presumed innocent.

How the scheme worked

The workers applied for remote jobs using stolen or fabricated identity documents, the department says. They used VPNs and proxy servers, which hide a computer's real location, so they appeared to be in the US.

Once a worker was hired, the company shipped a work laptop to a US address. US-based facilitators kept those laptops at home, in what officials call "laptop farms." They set the machines up and installed remote-access software so the workers could log in from abroad. They then forwarded the pay.

The Record reports that the victims included healthcare, cybersecurity, retail and manufacturing companies. TechCrunch reports the workers also used realistic email addresses and fake LinkedIn profiles.

Extortion and the new FBI warning

The department says North Korean IT workers have also stolen sensitive company data and demanded payment. The Record reports that some threatened to leak data unless paid large sums.

The FBI issued a new public service announcement on the same day. According to the department, the workers are increasingly recruiting American facilitators to avoid detection, and sometimes subcontract whole jobs to other foreign nationals. The Record, citing the FBI, says facilitators are being recruited in South Asia and West Africa, and that some target low-income Americans and active-duty military members to host laptops.

"These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices," said David M. Toepfer, the US Attorney for the Northern District of Ohio.

What this means for developers

For engineering managers and anyone who hires remote technical staff:

• Verify identity in person or through a trusted service. Stolen and fake identity documents were the entry point, so check them before the laptop ships.
• Watch where laptops go. Work machines were shipped to addresses that held many devices. Flag shipping addresses that do not match the employee's stated home, or that receive several company laptops.
• Monitor remote-access software. Facilitators installed remote-access tools on company laptops. Block unapproved tools and alert on new ones.
• Check the published indicators. The department listed 11 fraudulent email accounts tied to the scheme. Security teams can add them to applicant screening.
• Plan for extortion. Workers allegedly stole data and then demanded payment. Limit what new remote hires can reach until their identity is confirmed.