Back Cleveland Federal indictment details North Korean remote-work scheme with Ohio link
CLEVELAND, Ohio — Fourteen people have been indicted in a scheme that prosecutors say used stolen identities and U.S.-based “laptop farms” to help North Korean-affiliated IT workers get remote jobs with American companies, including at least one in Ohio.
The indictment, unsealed Tuesday in federal court in Cleveland, charges U.S. citizens and Chinese nationals with conspiracy to commit wire fraud, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. Two defendants were arrested recently and are expected to appear in the Northern District of Ohio. Others remain at large.
According to prosecutors, the scheme operated from 2019 through 2025 and affected more than 70 U.S. companies across multiple industries, generating $3 million in revenue that authorities believe was funneled to entities controlled by North Korea. Victim companies were located in Ohio and numerous other states.
Federal authorities said overseas IT workers used false or stolen identities to secure remote jobs with U.S. employers while concealing their true locations. The workers relied on facilitators in the United States who received company-issued laptops, hosted them at residences known as “laptop farms,” and enabled remote access from abroad, authorities said.
The indictment describes an Ohio connection through an uncharged co-conspirator who prosecutors say lived in Northern Ohio and operated a company that functioned as a shell business used to support the scheme by receiving laptops, managing accounts and moving money to overseas co-conspirators.
Court documents also say the conspiracy used Akron-area phone numbers and, in one instance, sought to hire an actor to appear at an in-person job interview in Akron while using a fraudulent identity.
Prosecutors say the operation compromised the identities of multiple American, transmitted false information to federal agencies and caused at least $3 million in losses and remediation costs for victim companies.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
