Federal agents searched more than 40 homes between September 21 and 25, mostly in North Texas, and seized about 187 laptops and keyboard, video and mouse (KVM) devices. The Justice Department and FBI announced the results on Tuesday, October 13, tying them to a North Korean laptop farm operation that touched more than 70 U.S. employers.
The Justice Department called the action coordinated pressure on North Korea's effort to fund its government through remote IT jobs at American companies. The package included an indictment, two arrests, searches of laptop farms in Texas and the seizure of about 187 devices. The department's release lays out the core of the case.
What the Ohio indictment charges
A 14-person indictment returned in Ohio on October 1 and unsealed on October 13 charges wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. The scheme ran from around 2019 to July 2025.
Ten defendants are China-based and remain at large. Two U.S. nationals have been arrested: Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. Two more defendants are under seal, and everyone charged is presumed innocent until proven otherwise.
John A. Eisenberg, assistant attorney general for national security, said North Korea's regime “uses its pervasive IT worker schemes to raise revenue for various illicit purposes,” as VOA reported. That framing treats the workers as a revenue stream for the regime, not only a fraud problem.
How a North Korean laptop farm works
The mechanism is simple and hard to spot from the employer's side. Workers used stolen or fabricated identities and VPNs to appear to be inside the United States. U.S.-based facilitators hosted company-issued laptops in their homes, installed remote-access software and forwarded the earnings to North Korean-controlled accounts. To the employer, the person on the company laptop looked like a domestic hire.
The money flows mostly one way. The FBI's advisory estimated that North Korea's government takes 85 to 90 percent of the revenue these workers generate. Across the case, the scheme sent roughly $3 million to sanctioned North Korean-controlled entities. CrowdStrike, which helped investigators, tracks the group as Famous Chollima.
Investigators are also pulling platform records. A federal magistrate judge in Ohio issued an October 9 order directing Google to produce records for 11 accounts the investigators say the workers used. Account data like that can tie a hired name to the devices and payments behind it.
The physical side of the case is the device seizure. About 100 of the seized devices came from North Texas, according to KRLD.
Which companies and workers face the most risk
Any company that hires remotely could be a target. Health care, communications, cyber support, retail and manufacturing stand out as sectors that could be targeted, according to Townhall's report on the case.
R. Joseph Rothrock, special agent in charge of the FBI's Dallas Field Office, put the scale in plain terms in the bureau's release: “Each laptop seized potentially represents one company that has hired a DPRK IT worker.” That line explains why the device count matters to employers beyond the courtroom.
Companies that hired these workers are treated as victims. A June 2026 analysis from Skadden found no enforcement action filed against companies that unknowingly hired the workers. The legal exposure is narrow, but the operational exposure is not. The FBI also reported threats against former managers and their families after workers were fired, along with threats to leak corporate data unless victims paid, as summarized by HSToday.
Individuals are exposed too. The Justice Department warned that hosting laptops for North Korean actors draws law enforcement attention, and people who host a company laptop or lend their identity may face federal charges. Identity-theft victims form another group, since the workers used stolen American identities and people whose names were misused may face records problems.
How this case compares with earlier laptop farm prosecutions
This is not the first large laptop farm case. The table puts recent matters side by side, using figures as reported.
| Case | Scale reported |
|---|---|
| 2023 Arizona laptop farm | Allegedly helped workers get jobs at 309 U.S. companies |
| Arizona woman's sentencing | 102 months; more than 300 companies and over $17 million in revenue |
| January 2025 DOJ charges | Jobs at at least 64 companies |
| June 2025 DOJ searches | 29 suspected laptop farms across 16 states |
| This case (October 2026) | More than 70 U.S. companies; about $3 million to North Korean-controlled entities |
The pattern has been building for more than a year. In November 2025, five men admitted helping workers get hired by U.S. companies. In April 2026, two New Jersey men were sentenced for a scheme that generated $5 million for North Korea. The Justice Department charged five people in January 2025 over a scheme that secured jobs at at least 64 companies, as Axios reported.
By company count, the 2023 Arizona case alleged a bigger footprint, with 309 companies. The Texas searches reached more than 40 residences in one state, while the June 2025 action covered 29 suspected laptop farms across 16 states. The units differ, so the cleaner takeaway is the shift toward coordinated, multi-part enforcement. Ryan Raybould, U.S. attorney for the Northern District of Texas, said in a news release, “This investigation is about far more than fraud.”
A Treasury estimate cited by a local outlet puts similar schemes at up to $800 million a year. That is a broader figure, not a finding in this case, and it should be read that way.
Steps hiring teams can take now
These steps are our own recommendations rather than government guidance, but each one targets a tactic described in the case.
- Verify remote candidates with live video or in-person checks, and compare the person on camera with a government ID during hiring and onboarding.
- Be cautious about shipping company laptops to any address that does not match the employee's verified location.
- Monitor company devices for unexpected logins, unfamiliar remote-access software and VPN activity, especially on machines that rarely leave the office.
- Report suspicious activity to the FBI's Internet Crime Complaint Center at ic3.gov, which the FBI asked for in its outreach.
What remains unclear and what comes next
The victim companies have not been named. The device count also varies, with most reports citing about 187 and some rounding to nearly 190. The ten China-based defendants remain at large, and the sources reviewed for this story did not yet describe court appearances for the two arrested Americans. It is also unclear how many hires were made through facilitators and how many companies were harmed without knowing it.
The Ohio docket will show whether the sealed defendants surface and how the Google records are used. Bringing the China-based defendants into a U.S. courtroom is far harder, and it will depend on cooperation from other governments. Enforcement pressure is also spreading to other fraud tools, as shown by Microsoft's takedown of the YAM Store, CoGUI and Iron Man phishing kits. The next clear signal will come from whether employers start reporting more suspicious hires to the FBI.
