North Korean IT Worker Fraud Scheme Exposed: 8+ Years in Prison for Key Conspirator

Strategic Insights -

A 50-year-old Arizona woman, Christina Chapman, has been sentenced to over 8 years in prison for her role in a complex fraud scheme that helped North Korean cyber operatives pose as Americans and obtain remote IT jobs at hundreds of US companies, including Fortune 500 corporations. The scheme, described as one of the largest North Korean IT worker fraud schemes, used the stolen identities of 68 Americans, defrauded more than 300 US businesses, and generated over $17 million in revenue, which could benefit the nuclear-armed North Korean regime.

Key Takeaways:

  • Christina Chapman, 50, pleaded guilty to orchestrating a complex fraud scheme that helped North Korean cyber operatives obtain remote IT jobs at hundreds of US companies, including Fortune 500 corporations.
  • The scheme used the stolen identities of 68 Americans, defrauded more than 300 US businesses, and generated over $17 million in revenue.
  • Chapman operated a "laptop farm" from her home, where she "received and hosted" company-issued computers on behalf of foreign IT workers to trick companies into believing the workers were living in the US.
  • The scheme involved shipping 49 laptops and other devices to various locations abroad, including a city in China near the North Korean border.
  • Chapman also received and forged payroll records using stolen identities, and funds were deposited into her personal US accounts and then transferred to individuals overseas.
  • The scheme was part of a larger effort by North Korea to deploy thousands of highly skilled IT workers around the world, including to the US, to circumvent controls employed by US companies.
  • Foreign IT workers involved in the scheme unsuccessfully attempted to obtain employment at two US government agencies.
  • The State Department and other agencies issued a warning about similar schemes in 2022, where North Korean IT workers, posing as from other nationalities, offered to work remotely and applied for jobs in various sectors.

Statistics:

  • 68 Americans had their identities stolen as part of the scheme.
  • More than 300 US businesses were defrauded.
  • Over $17 million in revenue was generated through the scheme.
  • 49 laptops and other devices were shipped to various locations abroad.
  • Over 90 laptops were found in Chapman's home during an October 2023 search.
  • Funds were deposited into Chapman's personal US accounts and then transferred to individuals overseas.

Sources:

  • CNN
  • Department of Justice (release)
  • Michael Barnhart, North Korea specialist at Google-owned cybersecurity firm Mandiant (statement)
  • White House official (statement, 2024)
  • State Department (warning, 2022)
  • CNN (previous reporting on North Korean IT worker schemes)