Treasury targets 10 individuals and one entity in DPRK IT-worker schemes

On October 28, 2026, the U.S. Treasury Department announced sanctions against 10 individuals and one entity that it said facilitated North Korean government-run IT-worker schemes targeting U.S. businesses. Treasury alleged that the networks used false identities, cryptocurrency, money laundering and AI tools, and that workers could gain access to corporate systems, deploy malware and remove sensitive data. For law firms and clients, sanctions screening should therefore extend beyond named vendors to beneficial owners, workers, payment routes and remote-access patterns, particularly when hiring through international staffing intermediaries. The second-order risk is that what begins as an employment or cybersecurity control failure can become a sanctions, data-breach and disclosure problem at the same time.