$17M IT Worker Fraud: Arizona Woman Sentenced for Aiding North Korea

A lengthy sentence, along with hefty fees, is what awaits a resident of the southwestern U.S. state who facilitated the hiring of numerous people using stolen identities.

The rise of the DPRK threat is a global concern, and its tactics are becoming increasingly sophisticated.

Details on The Arrest

A press release shared by the Office of Public Affairs in the United States describes a citizen of the state of Arizona, assisting North Korean Information Technology (IT) workers with a plot that generated more than $17 million in illicit profits for Chapman and the Democratic People’s Republic of Korea (DPRK).

The defendant, Christina Marie Chapman, 50, of Litchfield Park, Arizona, admitted guilt on February 11th in the District of Columbia for conspiracy to commit wire fraud, money laundering, and identity theft.

In addition to the 102-month jail sentence, U.S. District Court Judge Randolph D. Moss ordered Chapman to undergo three years of supervised release, forfeit the $284,555.92, which was intended for the North Korean workers, and pay an additional penalty of $176,850.

“Christina Chapman perpetrated a years’ long scheme that resulted in millions of dollars raised for the DPRK regime, exploited more than 300 American companies and government agencies, and stole dozens of identities of American citizens,” noted Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.

The case involved one of the largest DPRK IT worker fraudulent setups charged by the Department of Justice (DOJ), with 68 identities stolen from U.S. citizens, 309 local businesses, and two international businesses manipulated. Fortune 500 corporations were also affected.

According to court documents, there have been thousands of well-trained IT staff sent around the world, including the United States, from North Korea, gaining remote positions using fake or stolen identities. To address employment checks by companies, which would have prevented them from securing jobs, the workers were assisted by collaborators on US soil.

How The Scheme Was Executed

Chapman ran a “laptop farm,” where she received and hosted the machines from various organizations, deceiving them into believing the work was being performed locally.

The DPRK employees maintained a cache of job postings for companies that wanted to hire them, and they even attempted to breach different government agencies, but without success.

The affected enterprises include a top-five television network, a tech company from Silicon Valley, an aerospace manufacturer, an American car maker, a luxury retail store, and a media and entertainment company.

The accused also shipped 49 laptops and various other devices overseas, including multiple postings to a specific city in China, on the border of North Korea. Over 90 laptops were seized in total following the search of her property in October 2023.

A significant portion of the generated income from the fraud was inaccurately reported to the Internal Revenue Service (IRS) and the Social Security Administration, using the names of U.S. citizens whose identities had been stolen.

Additionally, Chapman forged payroll checks in the names of the defrauded identities used by the North Korean workers, and received wages for them in her personal bank account, which were then funneled overseas.

Special Agent in Charge Carissa Messick of the IRS Criminal Investigation (IRS-CI) Phoenix Field Office said:

“The scheme was elaborate. If this sentencing proves anything, it’s that no amount of obfuscation will prevent IRS-CI and our law enforcement partners from tracking down those that wish to steal the identities of U.S. nationals, launder money, or engage in criminality that jeopardizes national security.”