North Korean Spies Got Hired at 70 U.S. Companies. Here Is What Every Small Business Owner Needs to Know.

North Korean Spies Got Hired at 70 U.S. Companies. Here Is What Every Small Business Owner Needs to Know.

Imagine shipping a laptop to your newest remote hire, only to find out that person never existed. The name was stolen, the identity was fabricated, and the individual on the other end of that computer is a sanctioned North Korean operative funneling your company's sensitive data straight to Pyongyang. This is not a thriller plot. According to the U.S. Department of Justice, it has already happened at least 70 times across American businesses.

On October 13, 2026, the DOJ announced a sweeping enforcement action revealing that North Korean state-controlled IT workers have successfully infiltrated at least 70 U.S.-based companies across sectors including healthcare, retail, communications, cyber support, and manufacturing. Federal authorities seized over 180 computers that victimized companies had shipped to what they believed were newly hired remote employees. In reality, those machines were routed to "laptop farms" across Texas, with at least 40 locations raided during the operation. Two American facilitators were indicted and arrested for allegedly running these farms and serving as go-betweens connecting the North Korean operatives to unwitting U.S. employers. The stolen funds from this particular scheme totaled approximately $3 million, with affected companies spread across Ohio and 16 other states, including the District of Columbia.

Cybersecurity firm CrowdStrike, which assisted the FBI in investigating and disrupting this operation, described laptop farms as "vital" infrastructure for North Korea because they allow operatives to appear physically present in the United States while actually operating from abroad. The North Korean workers obtained jobs using stolen identities of real U.S. citizens, supported by convincing fake LinkedIn profiles, professional email addresses, and elaborate social media backstories. Once embedded inside a company, they stole sensitive data and intellectual property, and then used that access to extort their employers further. The FBI has stated that "thousands" of North Korean state-controlled IT workers are currently embedded at Western companies, calling it "a significant national security and intellectual property theft insider threat." CrowdStrike separately reported earlier this year that North Korean hackers were responsible for roughly half of all documented hands-on intrusions over the past year. The North Korean regime is estimated to have stolen at least $2 billion in cryptocurrency during 2025 alone through related schemes.

For small and mid-size business owners, the instinct might be to assume this only happens to large enterprises with complex supply chains and hundreds of employees. That assumption is dangerous. The companies named in this DOJ action span retail, healthcare, and communications sectors, which means businesses of virtually any size are potential targets. The remote work revolution that helped so many small businesses access affordable, geographically dispersed talent has also expanded the attack surface dramatically. When your hiring process is entirely digital, and when you ship equipment directly to a new contractor or employee without meeting them in person or rigorously verifying their identity through multiple independent channels, you have created exactly the kind of opening these operations are designed to exploit.

The marketing and customer trust implications are equally serious. A data breach or intellectual property theft event does not just cost money. It destroys the credibility you have spent years building with customers. If a healthcare or retail business is compromised, customer records, payment data, and proprietary business processes can all be exposed. And when that breach becomes public, which DOJ enforcement actions often do, the reputational damage can be lasting. For small businesses competing on trust and personal relationships, this is not a recoverable situation without significant effort. The time to protect that trust is before an incident occurs, not after.

This week, build a written remote hiring verification protocol if you do not already have one. Specifically, add a step that requires a live video identity verification call with any new remote hire before you ship equipment to them. Cross-reference the name, face, and contact information provided against a government-issued ID on camera. This single friction point is inexpensive, takes under 30 minutes per hire, and directly addresses the method used in the North Korean scheme. The DOJ noted that improved private sector detection is already forcing these operatives to adapt their tactics, which means your diligence creates genuine deterrence.

The same AI-powered strategies that help your business grow faster also require that your operational foundation be secure. At Leads to Conversion, we help small and mid-size business owners build smarter, safer marketing systems that scale.

Originally inspired by: Justice Department says North Koreans have infiltrated dozens of U.S. companies (https://techcrunch.com/2026/10/13/justice-department-says-north-koreans-have-infiltrated-dozens-of-u-s-companies/) See how Leads to Conversion can help protect and grow your business with AI. Get your free AI audit

Your turn

What is your traffic actually doing?

Send us your details and we will come back with a short, specific read on what your traffic, your pages and your pipeline are doing today — and the first three things we would change. A real person reads every submission, and you get the read whether or not we ever work together.