Ohio indictment alleges scheme reached 70-plus U.S. employers

A federal indictment in Ohio charges 14 people in an alleged remote IT-worker scheme that prosecutors say affected more than 70 U.S. employers and generated about $3 million in revenue for IT workers. The Justice Department announced the charges and two arrests on Oct. 13, 2026. DOJ says investigators believe the revenue was sent to sanctioned entities controlled by North Korea.

The indictment describes an alleged scheme that ran from 2019 until about July 2025. Prosecutors say participants used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to obtain remote IT jobs. U.S.-based facilitators allegedly hosted computers issued by employers, allowing workers elsewhere to perform the jobs while appearing to connect from within the United States.

Four-count indictment names 14 defendants

The two people arrested in Ohio are Michael James Bostelle and Juan Cecilio Pena Carrillo, both U.S. nationals. The indictment also names 10 China-based defendants. The identities of two additional defendants remain under seal, according to the Justice Department.

The four-count indictment involves allegations of wire fraud, money laundering and identity theft. The Justice Department has not provided a count-by-count breakdown. The approximately $3 million is described as revenue for IT workers; it is not a final accounting of money transferred to North Korea. DOJ says investigators believe that revenue went to sanctioned North Korean-controlled entities.

The alleged employer victims were in Ohio, 16 additional states and Washington, D.C. The Justice Department identifies health care, communications, cyber support, retail and manufacturing among the affected industries. The indictment does not establish that every employer experienced a data breach or another specific loss.

Texas searches were a separate operation

Separately, the FBI searched more than 40 Texas residences from Sept. 21 to 25, 2026, under Operation Lonestar Roundup. Authorities described the residences as known or suspected laptop farms. The FBI seized approximately 187 devices, including laptops and keyboard-video-mouse (KVM) equipment.

The Texas searches were a distinct enforcement action announced alongside the Ohio case; they were not part of the Ohio indictment. The searches and seizures are the reported action in Texas, while the indictment and arrests concern the Ohio case.

Federal officials say schemes of this kind can threaten employers’ systems and data and expose people to identity theft. In the Ohio allegations, prosecutors describe false or stolen identities and U.S.-based computer hosts as parts of a method for obtaining remote work while obscuring where workers were connecting from.

The indictment contains allegations, not findings of guilt. The Justice Department says the defendants are presumed innocent and that the investigation is ongoing.