On Oct 13, 2026, the U.S. Department of Justice announced coordinated actions against Democratic People’s Republic of Korea (DPRK) remote IT-worker schemes that allegedly placed workers into U.S. companies using stolen or fabricated identities and U.S.-based “laptop farms.”
• 14 people charged; two U.S. nationals arrested under a Northern District of Ohio indictment (wire fraud, money laundering, identity theft) returned Oct 1 and unsealed Oct 13
• Operation Lonestar Roundup (Sept 21–25): searches at 40+ Texas residences known or suspected as laptop farms; ~187 laptops and KVM devices seized
• Scheme allegedly affected more than 70 U.S. employers across health care, communications, cyber support, retail, and manufacturing, generating $3 million in revenue believed sent to DPRK-controlled entities
• CrowdStrike separately describes a firsthand role identifying FAMOUS CHOLLIMA laptop-farm infrastructure and assisting FBI disruption; public reporting also notes wider DPRK IT-worker activity may continue
These are charging allegations — defendants are presumed innocent until proven guilty. Seizing ~187 devices does not equal confirmed breaches at every employer named in the scheme. CrowdStrike and FBI framing treat this as a disruption of one facilitation network, not an end to DPRK remote-IT revenue generation. Hiring-control and identity-verification guidance from FBI PSAs remains the practical takeaway for employers.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
