The FBI searched more than 40 suspected "laptop farms" in Texas on September 21-25, 2026, as part of a case charging 14 people connected to a North Korean scheme that placed fraudulent IT workers inside more than 70 US companies — including manufacturing firms — across 17 states (Help Net Security, 2026). If your business hires remote developers or IT contractors, this isn't a distant story about nation-state espionage — it's a hiring and vendor-vetting problem that already reached companies your size.
What Is a "Laptop Farm," Exactly?
A laptop farm is a US-based location — often just someone's home — where a paid American keeps company-issued laptops physically present and running on behalf of a remote worker who is actually overseas and not who they claim to be. According to prosecutors, operatives working for North Korea used stolen or fabricated identities to get hired at legitimate US companies, then had an American "facilitator" receive the shipped laptop, install remote-access software on it, and keep it running so the real worker abroad could log in and do the job while appearing to be a US-based employee (Help Net Security, 2026).
How Did This Scheme Actually Get Past Hiring Processes?
By exploiting the fact that remote hiring rarely verifies a person beyond documents and a video call — and this scheme specifically targeted that gap. Investigators allege some operations paid Americans to sit in on video interviews, verify fabricated identities, or lend their social media and professional networking profiles to make a fake candidate look real. In the Ohio case alone, prosecutors allege roughly $3 million in earnings were collected between 2019 and mid-2025 and routed to accounts controlled by North Korea, with the government reportedly keeping an estimated 85-90% of what these workers earned (Help Net Security, 2026).
Is This Just an Espionage Story, or an Actual Business Risk?
It's a direct business risk, not just a national security headline. Beyond the fraud itself, some workers with access to sensitive personal data allegedly exfiltrated it, and in isolated cases attempted to extort the companies that had employed them. Several, after being terminated, reportedly made threats against former managers and their families, or threatened to leak corporate data unless paid (Help Net Security, 2026). That combination — a fraudulently placed worker with real system access, followed by extortion after termination — is exactly the kind of insider-threat scenario standard background checks aren't built to catch.
What Should a Business Actually Watch For?
The tactics described in this case point to specific, checkable red flags: a candidate who avoids live video or seems inconsistent between interview and on-the-job behavior, a shipped company laptop going to an address that doesn't match the employee's stated location, login activity or geolocation that doesn't line up with where the employee claims to work, unexpected remote-access software appearing on a company device, and unusual data access or download patterns from anyone handling sensitive personal information. The FBI's own advisory notes that operatives "strategically target those under financial stress" when recruiting American facilitators — worth keeping in mind for any role involving physical custody of company hardware, not just the remote worker role itself.
What Can a Business Do About This Right Now?
Verification needs to go beyond a document check: consistent, live video interviews across the hiring process (not just the first interview), confirming that shipping addresses and device check-in locations match what the employee claims, and monitoring company laptops for unauthorized remote-access tools are all concrete, implementable steps. Limiting and auditing access to sensitive personal data — especially for anyone hired quickly through a staffing agency or contractor pipeline — closes the specific gap this scheme exploited. Businesses that discover suspicious activity matching this pattern should report it to the FBI rather than handling it quietly, since this is an active, ongoing federal investigation.
Frequently Asked Questions
What is a North Korean "laptop farm"?
It's a US-based location, often a private home, where a paid American keeps company laptops physically present and connected so that a fraudulently hired remote worker — actually based overseas and using a false identity — can access company systems and appear to work from a legitimate US location.
How many companies were affected by this scheme?
More than 70 US companies across 17 states and Washington, D.C., spanning healthcare, communications, retail, and manufacturing industries, according to the Department of Justice case described in the October 2026 reporting.
What are the warning signs of a fraudulent remote IT hire?
Key red flags include reluctance to appear consistently on live video, a shipped laptop going to an address inconsistent with the employee's stated location, login patterns that don't match claimed geography, unexpected remote-access software on company devices, and unusual data access behavior.
Can this kind of scheme affect a small or midsize business?
Yes. The named victim companies spanned multiple industries and sizes, and the scheme specifically targets the gaps in standard remote-hiring verification that any company — not just large enterprises — relies on.
What should a company do if they suspect they've hired a fraudulent remote worker?
Document the specific inconsistencies (identity, location, device activity), restrict that account's access immediately, and report the activity to the FBI, since this is tied to an active federal investigation rather than an isolated incident to resolve quietly.