What is a laptop farm? How North Korean IT workers got hired at 70+ US companies — 40 Texas homes searched
A laptop farm is a location inside the US, often a private home, where a facilitator keeps company-issued laptops running so that workers abroad can log in remotely and pass as local employees. North Korean IT workers using stolen or fabricated identities are the best-known users. On October 13, 2026 the US Justice Department announced charges against 14 people and the arrest of two Americans, after FBI searches of more than 40 suspected laptop farms in Texas that seized about 187 devices; the scheme reached more than 70 US companies
The three lines
- Definition — company laptops kept on in a US home so overseas workers can pose as local staff
- Case — 14 charged, two Americans arrested, 40+ Texas homes searched, about 187 devices seized
- Scale — 70+ US companies, about $3M in pay, 25+ stolen identities, 2019 to 2025
Key questions
- Laptop farm meaning
- **A local base that keeps company laptops online so remote workers abroad look like domestic employees.** | Step | What happens | |---|---| | 1. Hire | Stolen or fake identity passes a remote developer interview | | 2. Laptop | Employer ships a work laptop to a US address (the facilitator) | | 3. Access | Facilitator installs remote-access software; worker logs in from abroad | | 4. Pay | Salary flows through accounts in false names and out of the country |
- DOJ North Korean IT worker laptop farm Texas October 2026
- **The Justice Department announced the action on October 13, 2026.** | Item | Detail | |---|---| | Charged | 14 (Northern District of Ohio) | | Arrested | Two US citizens (Pennsylvania, Texas) | | Searches | Sept 21-25, 40+ Texas homes | | Seized | About 187 laptops and devices | | Victims | 70+ US companies | | Pay collected | About $3M | | Charges | Wire fraud, money laundering, identity theft conspiracies; aggravated identity theft |
- How to spot North Korean IT workers
- **The FBI recommends layered checks throughout employment, not just at hiring.** | Signal | Detail | |---|---| | Proxy interviews | Paid Americans attend interviews or drug tests | | Device spoofing | Capture cards posing as webcams; spoofed device IDs | | Laptop address | Shipping address differs from hiring records | | After firing | Threats to managers; extortion with stolen data |
A laptop farm is a house that pretends to be an office. When a company hires a remote employee, it ships a work laptop. In a laptop farm, that laptop sits on a shelf in someone's home in the US — often next to ten or twenty others — switched on around the clock, while the actual worker logs in from the other side of the world. To the employer's security tools, it looks like an American employee working from an American home.
North Korean IT workers have used this method more systematically than anyone. On October 13, 2026, the US Justice Department announced charges against 14 people for using laptop farms to place workers at more than 70 US companies. Two Americans were arrested. Between September 21 and 25, the FBI searched more than 40 Texas homes suspected of operating as laptop farms and seized about 187 laptops and other devices.
1. How a laptop farm works
| Step | Worker abroad | US facilitator | What the employer sees |
|---|---|---|---|
| 1. Apply | Uses a stolen or fake identity to apply for remote developer jobs | Lends a name and ID, or attends the interview | A US citizen applicant |
| 2. Hire | Passes video interviews | Handles drug tests and paperwork | A normal hire |
| 3. Laptop | — | Receives and powers on the work laptop | Delivered to a US address |
| 4. Work | Logs in through remote-access software | Keeps power and network running | A US IP address logging in |
| 5. Pay | Receives money abroad | Collects salary in false-name accounts and passes it on | Normal payroll |
The indictment describes exactly these roles. An Ohio man named as an uncharged co-conspirator allegedly kept about two dozen company laptops online with remote-access software and moved more than $320,000 through accounts in false names. The man arrested in Texas allegedly hosted laptops under various names and received about $190,000 from five employers. The man arrested in Pennsylvania allegedly provided his name and a fraudulent driver's license. Together they filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity-theft victims.
2. The case in numbers
| Item | Detail |
|---|---|
| Announced | October 13, 2026, US Justice Department |
| Court | Northern District of Ohio (indictment unsealed) |
| Defendants | 14 — two US citizens arrested, ten believed in China, two unnamed |
| Searches | Sept 21-25, 40+ homes in Texas |
| Seized | About 187 laptops and devices |
| Period | 2019 to July 2025 |
| Impact | 70+ US companies; about $3 million in pay |
| Charges | Conspiracy to commit wire fraud, money laundering and identity theft; aggravated identity theft |
| Reward | State Department offers up to $5 million for information disrupting the scheme |
A US attorney described the case as "a hostile foreign regime infiltrating American companies through stolen identities." The US government says such earnings help fund North Korea's weapons programs.
3. The tactics are evolving
| New tactic | Detail | Source |
|---|---|---|
| Paid stand-ins | Financially strained Americans paid to attend interviews, take drug tests, access accounts | FBI advisory |
| Outsourcing the outsourcing | Actual work passed to freelancers in Pakistan, India and Nigeria | FBI advisory |
| Device spoofing | Video capture cards made to look like webcams; spoofed device IDs; one disguised device reused across jobs | CrowdStrike (since May) |
| Retaliation | Threats to former managers, extortion with stolen data, people sent to intimidate companies in person | FBI advisory |
The FBI advises layered verification throughout employment rather than a single check at hiring — while warning that blunt filters will screen out legitimate applicants.
4. What employers can check, and open questions
| Check | What to look for |
|---|---|
| Laptop shipping address | Matches hiring records? Several employees at one address? |
| Access logs | Remote-access software installed? Login hours match the claimed time zone? |
| Video calls | Real webcam? Face matches ID? |
| Payroll | Account name matches employee? Frequent changes? |
- Victim list: The 70+ companies have not been named.
- Defendants abroad: The ten believed to be in China are not in custody.
- Confirmation: Not every searched home is a confirmed laptop farm, and all allegations remain unproven.
Sources
- US Department of Justice — Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes
- CyberScoop — DOJ charges 14 over a sprawling North Korean remote work scheme
- The Hacker News — U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
- TechCrunch — Justice Department says North Koreans have infiltrated dozens of US companies