Arizona Woman Sentenced for Aiding North Korean IT Workers in Cyber Operations

Christina Marie Chapman, a 50-year-old Arizona woman, has been sentenced to 102 months in prison for her role in an elaborate fraud scheme that helped North Korean IT workers pose as U.S. citizens to obtain remote positions at over 300 American companies.

The scheme generated more than $17 million in illicit revenue for both Chapman and the Democratic People’s Republic of Korea (DPRK), representing one of the largest North Korean IT worker fraud cases prosecuted by the Department of Justice.

Key Takeaways:
1. Christina Marie Chapman was sentenced to 102 months for aiding North Korean IT workers in a $17M fraud scheme.
2. The scheme involved a "laptop farm" operation, stealing 68 U.S. identities to defraud over 300 businesses.
3. The fraud targeted major U.S. corporations and even attempted infiltration of U.S. government agencies.

The Sophisticated “Laptop Farm” Operation

Chapman operated what authorities described as a “laptop farm” from her Litchfield Park, Arizona home, where she received and hosted computers from U.S. companies to deceive employers into believing work was being performed domestically.

The operation involved stealing 68 identities from U.S. victims and defrauding 309 U.S. businesses plus two international companies.

Key operational details of Chapman’s scheme included:

• Device Management: Shipped 49 laptops and other devices supplied by American companies to overseas locations, including multiple shipments to a Chinese city bordering North Korea
• Evidence Seized: Over 90 laptops were confiscated from her home during an October 2023 search warrant execution.
• Organization System: Laptops were meticulously organized and labeled with notes identifying the associated U.S. company and stolen identity.
• Financial Operations: Received and forged payroll checks in stolen identities’ names and transferred proceeds overseas.
• Target Selection: North Korean workers maintained a repository of job postings from companies they specifically wanted to infiltrate.

The North Korean IT workers maintained a repository of job postings from companies they specifically wanted to target for employment.

Chapman facilitated their success by providing a U.S.-based address for device shipments and internet connections that appeared domestic to employers.

High-profile American Institutions Targeted

The fraud targeted high-profile American institutions, including a top-five major television network, a Silicon Valley technology company, an aerospace manufacturer, an American carmaker, a luxury retail store, and a U.S. media and entertainment company.

The North Korean workers even attempted to obtain positions at two different U.S. government agencies, though these efforts were generally unsuccessful.

Much of the millions generated was falsely reported to the IRS and Social Security Administration using the names of actual U.S. individuals whose identities had been compromised.

“North Korea is not just a threat to the homeland from afar. It is an enemy within,” stated U.S. Attorney Jeanine Ferris Pirro, emphasizing that the scheme represents a direct threat to American businesses and financial institutions.

Acting Assistant Attorney General Matthew R. Galeotti noted that Chapman’s actions “exploited more than 300 American companies and government agencies and stole dozens of identities of American citizens.”

Law Enforcement Response and Prevention Efforts

In addition to Chapman’s 102-month prison sentence, U.S. District Court Judge Randolph D. Moss ordered three years of supervised release, forfeiture of $284,555.92 intended for North Korean workers, and a judgment payment of $176,850.

The case was investigated by the FBI Phoenix Field Office and the IRS Criminal Investigation Phoenix Field Office.

Authorities have issued multiple guidance documents for HR professionals and companies to detect North Korean IT worker infiltration, building on previous advisories from May 2022, October 2023, May 2024, and January 2025.

The coordinated law enforcement response demonstrates ongoing efforts to combat this sophisticated international fraud network that directly funds North Korea’s nuclear weapons program.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!