Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

$3 million over 40-plus residences is $75,000 each, and no document says that

Divide the approximately $3 million that an Ohio indictment alleges by the "over 40" Texas residences the FBI searched, and the answer is $75,000 a residence (derived). No Justice Department document states that figure, and the division is not valid. The $3 million is an alleged total for more than 70 US companies over a charging period of nearly seven years. Neither department release says that any of the 40-plus residences produced any of it.

The headline "U.S. Shuts Down Over 40 Laptop Farms, Charges 14" repeats the shape of one sentence in an FBI statement inside the department's release of 13 October 2026: "charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected 'laptop farms'". The documents place the first two in an Ohio indictment and the last two in a Texas operation. The department calls them coordinated actions. It does not say that any person charged hosted any residence searched.

This briefing reads the primaries, not the press. They are the Office of Public Affairs release of 13 October (number 26-1171), the two US Attorney's Office releases of the same day, the 58-page indictment, the FBI public service announcement of the same day, CrowdStrike's post, the State Department's Rewards for Justice page and the 2022 advisory the release cites. The indictment is a scanned PDF, so it was read by optical character recognition and checked by eye on the pages that carry the key figures. Five news stories were read for their counts. Everything was read between 19:05 and 19:40 BST on Wednesday 14 October 2026.

What the record does not establish matters as much as what it does. It does not say how many of the residences stopped operating, how many companies' laptops are among the 187 devices, how many workers there were, or whether any UK company was affected. Everything about the 14 people is an allegation: the department says an indictment "is only a charge and is not evidence of guilt". No defendant, agent or prosecutor is named here, on purpose.

Two actions, two sets of numbers, one announcement

Each action has its own prosecuting office, its own dates and its own figures. The table sets out what each release states. The diagram draws the dates to scale.

What each of the two actions states about itself, from the Northern District of Texas release, the Northern District of Ohio release, the department's release 26-1171 and the indictment (all 13 October 2026).

Item	Operation Lonestar Roundup (Texas)	The indictment (Ohio)
Who	US Attorney's Office for the Northern District of Texas, with the FBI's Dallas office and Cyber Division. The Ohio office gave "valuable assistance".	US Attorney's Office for the Northern District of Ohio and the FBI's Cleveland office, prosecuted with a Justice Department national security trial attorney (the two releases name the unit differently).
When	Searches 21 to 25 September 2026, five days.	Returned by a grand jury on 1 October 2026 and unsealed on 13 October, 12 days later (derived). A "year-long investigation".
What	Searches and "other law enforcement action" at over 40 residences. About 187 laptops and KVM devices seized over the operation.	A 58-page, four-count indictment: conspiracy to commit wire fraud and mail fraud, money laundering conspiracy, conspiracy to commit identity theft, aggravated identity theft.
People	No one is charged in the Texas office's own release. "The investigation remains ongoing."	14 defendants: two US citizens (both arrested), ten named non-US defendants, two under seal. A third US person is named and not charged.
Money and companies	Not stated.	About $3 million in alleged revenue to the overseas workers. Victim losses of at least $3 million. More than 70 US companies.
Period	Not stated beyond the five days.	General allegations: 2019 to in or around July 2025. Counts 1 to 3: 1 February 2019 to 21 January 2026.

Two features of the calendar matter. The searches began on 21 September 2026, about 8 months (243 days, derived) after the date on which the counts end, 21 January 2026, and 14 to 15 months after the "in or around July 2025" that the department's release gives as the end of the scheme. The release does not say whether any residence searched was operating in the charged period. And the grand jury returned the indictment six days after the searches ended, which is consistent with coordination and is not evidence of overlap.

Where the sources count differently

Five outlets covered the story on 13 and 14 October. They agree on 14 charged and two arrests. They differ on most else, and the differences follow the headline's fusion of two actions. Where a news story and a primary differ, this briefing follows the primary and says so.

Counts in the department's documents against counts in press and vendor accounts, read 14 October 2026. The Hacker News, SecurityWeek, The Record, CyberScoop and Help Net Security are secondary.

Item	The department's documents	Where press or vendor accounts differ
The 40-plus places	Searches and "other law enforcement action" at "over 40 residences" "known to be, or suspected of operating as, laptop farms". The Texas office's text says they "had operated as laptop farms".	The Hacker News: "Shuts Down Over 40 Laptop Farms" and "dismantling". Help Net Security: "FBI raids 40+ laptop farms". SecurityWeek: "40 locations". CrowdStrike: "several laptop farms operating across the U.S."
Devices	About 187 laptops and KVM (keyboard, video, mouse) devices over the whole operation. The FBI's Cyber Division says "nearly 190 devices".	CyberScoop: "roughly 187 computers". The Record: "laptops and other devices". The number of laptops apart from KVM devices is not stated anywhere.
Who is charged	14 defendants: 12 named, 2 under seal. The Ohio release says "U.S. citizens and Chinese nationals". Its list gives a place in China for 8 of the 10 non-US names and "unknown location" for 2 (derived). The department's summary calls all 10 "China-based".	The Record: "Chinese and North Korean nationals" were indicted. No release names a North Korean national among the 14. The Hacker News lists 12 names under a headline of 14.
Counts and statutes	The summary says "a four-count wire fraud, money laundering, and identity theft indictment". In the indictment, Count 1 is conspiracy to commit wire fraud and mail fraud, Count 2 money laundering conspiracy, Count 3 conspiracy to commit identity theft, and Count 4 aggravated identity theft, which names four defendants. No count cites a sanctions statute.	The Ohio release lists all four offence types against "the following defendants", which reads as every named defendant on every count.
Period	"From 2019 to in or around July 2025" (release; indictment para 8). Counts 1 to 3: 1 February 2019 to 21 January 2026. Count 4: 11 December 2023 to 25 September 2025.	The Record: "2019 to 2026". CyberScoop: "2019 through 2025". SecurityWeek and Help Net Security: to July 2025. Each matches a different part of the indictment.
Money	"Approximately $3 million in revenue for IT workers" and, in the same release, "more than $3 million in revenue". Para 15 of the indictment adds victim losses of "at least $3 million". The revenue is "believed to have been sent to sanctioned entities controlled by the DPRK".	The Record's headline: laptop farms "responsible for $3 million". CyberScoop: "about $3 million in pay". Neither mentions the second $3 million, the victim losses.
Companies and states	"More than 70" companies in "Ohio, sixteen additional states, and the District of Columbia". The indictment's 33 numbered companies sit in 17 states, and 4 of those states are missing from its own list in para 16 (21 states in all, derived).	The Record: "about 70" companies "across 17 states". CrowdStrike: "dozens of victim organizations" in the clusters disrupted. FBI Dallas: "Each laptop seized potentially represents one company".
Arrests	Two US citizens "recently arrested". Where, when and in connection with what is not stated.	SecurityWeek and The Record headline the arrests beside the Texas raids. The Record says the department did not respond when asked whether the arrests were linked to the raids.
Reward	The release says the State Department has offered "potential rewards for up to $5 million in support of international efforts to disrupt the DPRK's illicit financial activities". Rewards for Justice: up to $5 million "for information that leads to the disruption of financial mechanisms" of persons engaged in certain activities.	CyberScoop: rewards "for further information that disrupts this scheme".
Earnings	Workers "have been known individually to earn up to $300,000 annually".	The May 2022 advisory the release cites says "more than USD 300,000 a year in some cases", and that teams "can collectively earn more than USD 3 million annually".

The arithmetic, labelled derived

Every figure here is derived in code from numbers the department's documents state. A derived figure is a calculation, not a finding. Where a division is not valid, the table says so.

Derived figures and their working. Inputs: release 26-1171, the two US Attorney's Office releases, the indictment, the May 2022 advisory, Treasury's release of 12 March 2026 and the department's release of 30 June 2025.

Derived figure	Working	What it does and does not mean
$75,000 a residence	$3,000,000 divided by 40	Not valid. The $3 million is the Ohio indictment's alleged revenue. No document attributes any of it to the Texas residences. "Over 40" makes the true quotient smaller, so it is at most this.
At most 4.7 devices a residence	187 divided by 40	The 187 are laptops and KVM devices, so laptops are fewer. In June 2025 the department reported searches of 29 farms and about 200 computers seized in the same action, 6.9 a farm (derived). The FBI says actors now run more farms with fewer laptops at each. The two counts use different bases, so this fits the FBI's statement and does not prove it.
At most about $43,000 a company	$3,000,000 divided by 70	"More than 70" companies, so the true average is lower. It is revenue to the workers, not salary, and it is lumpy: one company is alleged to have transferred over $600,000 to one persona (para 181), at least 20 per cent of the total (derived).
About $430,000 a year	$3,000,000 over 6.97 years (1 February 2019 to 21 January 2026, 2,546 days)	The 2022 advisory says a team can earn more than $3 million a year, so this alleged group's yearly revenue is about 14 per cent of one such team-year (derived). Treasury's "nearly $800 million in 2024" is about 267 times the group's whole-period revenue. One alleged group looks small beside the programme the department describes (inference).
8 months, and 14 to 15 months	21 January 2026 to 21 September 2026 is 243 days. End of July 2025 to 21 September 2026 is 417 days; start of July 2025 to the same date is 447 days	The searches began months after the charged conduct ended. The release does not say whether any residence searched was active in the charged period.
12 of 14	14 defendants less 2 in custody	"All other defendants in this case remain at large"; two are under seal. At least 10 named defendants are at large (derived).
8 of 10	Non-US named defendants with a place in China in the Ohio release; 2 are "unknown location"	The summary calls all ten "China-based". No North Korean national is named among the 14, going by "U.S. citizens and Chinese nationals" (derived from the wording).
21 states and the District of Columbia	Para 16 lists 17; the 33 numbered companies sit in 17. Only para 16: Arkansas, Georgia, Maryland, North Carolina. Only the numbered list: Colorado, Delaware, Nevada, Oregon	The department's "Ohio, sixteen additional states" matches para 16. The indictment itemises 33 of "more than 70" companies, at most 47 per cent (derived); the rest are not described.
12 laptops in 8 packages	Paras 296 to 303: 2, 4, 1, 1, 1, 1, 1 and 1	The indictment alleges that laptops were also shipped abroad by courier, from the Ohio residence to defendants in China. A farm can be a relay as well as a shelf. These are minimums: each package held "other items".

Stated and not stated: the record, line by line

"Not stated" means not found in the department's three releases, the indictment, the FBI announcement or the CrowdStrike post, all read in full. It does not mean the information does not exist.

What the department, the FBI and CrowdStrike state about the 13 October 2026 actions, and what they do not.

The question	Stated	Not stated
How many farms were shut?	Over 40 residences searched, 21 to 25 September 2026. 187 laptops and KVM devices seized across the operation. The Texas office's headline says "dismantles"; its text says "disrupted". CrowdStrike expects "limited impact" and effects "unlikely" to last.	How many residences stopped operating, how many were still operating on 21 September, whether any occupant was charged or interviewed, and the count of laptops apart from KVM devices.
Did the arrests come from the searches?	"Coordinated actions". The Ohio office gave "valuable assistance" to the Texas operation. Two US citizens "recently arrested".	Where or when the two were arrested, and whether either hosted any of the 40-plus residences. The Ohio release lists one at an address in Pennsylvania and one in Texas.
How many companies?	More than 70 in the indictment. "Dozens" in the clusters CrowdStrike says were disrupted. "Potentially" one company per laptop, says FBI Dallas.	Any victim's name, how many companies are behind the 187 devices, any overlap with the 70, and whether any non-US company was affected.
How many workers?	The FBI: "thousands" of state-controlled workers and "dozens" of teams. The indictment lists ten named overseas people and two redacted names as one group of overseas IT workers (para 8).	How many workers held the 70-plus jobs, how many were North Korean nationals, and how many jobs were done by hired freelancers.
How much reached North Korea?	About $3 million of revenue for the overseas workers, "believed" sent to entities the DPRK controls. The FBI says the government "receives an estimated 85-90%" of what workers generate.	Any traced amount or route. The forfeiture allegations name categories of property, not sums.
Who is not charged?	The indictment names a US co-conspirator "named but not charged", who is alleged to have run an Ohio shell company, recruited and trained facilitators, and kept about two dozen company laptops in April 2023. The overseas group is said to have directed at least four other US persons (para 11).	Why that person is not charged, and whether any of the other US persons will be. The Record reports that the department did not say.
Any sanctions charge?	Counts of conspiracy to commit wire and mail fraud, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. The background paragraphs recite UN and US sanctions.	Any count under the sanctions statutes.
Are victims named?	Victim Companies 1 to 33, by number and state. Sectors: health care, communications, cyber support, retail and manufacturing.	Any company name, and which sector goes with which company.
Any UK link?	Victims are in US states and the District of Columbia. The UK does not appear in the three releases, the FBI announcement, the CrowdStrike post or the indictment.	Whether any UK company, facilitator or worker was involved.

Five friendly names and what the record shows behind them

A label is not a control. Five labels in this story each suggest more than the record shows, and three of them stand in for an identity check.

Labels, what each suggests, and what the FBI, the 2022 advisory, CrowdStrike and the indictment (allegations only) show.

The label	What it suggests	What the record shows
"Laptop farm"	A room of machines in one place, run by a criminal.	An ordinary residence. The FBI says an arrangement "often called" a laptop farm keeps devices connected "from non-alerting locations, such as personal residences", and that actors now keep more farms with fewer laptops at each. CrowdStrike calls a farm "a rented U.S. footprint: a physical address, a legal identity, and a mechanism to satisfy 'know your client' regulations". The indictment alleges laptops were also shipped on to defendants in China.
"Shut down" or "dismantled"	The capability is gone.	Searches and seizures at residences. The Texas office's text says "disrupted". CrowdStrike: the action is "unlikely to create long-lasting effects".
"Remote worker", "contractor", "freelancer", "freelance platform"	A person who is who they say, doing the work they were hired for.	The FBI: actors pay Americans to "appear on camera, participate in job interviews or meetings, verify fraudulent identities", and in some cases subcontract "entire jobs" to foreign nationals. The 2022 advisory says workers use proxy accounts that "belong to third-party individuals" on freelance software developer websites. The indictment alleges that one individual took an online interview under a facilitator's identity and that a second individual used the same identity at the onboarding meeting (paras 140 and 143).
"Background check passed"	The person has been checked.	It verifies a record, not the person at the keyboard. The FBI says actors "often purchase accounts or licenses from identity verification providers to validate and confirm the stolen PII will pass employment background checks". The indictment alleges fictional employment references built on fraudulent email addresses and telephone numbers, "fraudulently notarized attestations", and a Texas company set up to provide "validation of past employment". CrowdStrike's own advice is to run a standard check and then look for further indicators.
"Shipped to the address on the ID"	The device went to the employee.	The FBI and the 2022 advisory both advise it, and it is a sound control. It passes when the facilitator's own real name and home are on the identity. For one hire the indictment alleges a laptop sent to the facilitator's own name and address while a second individual used the identity at onboarding (paras 142 and 143).

Two interests are worth stating. The department and the FBI are describing their own operation. CrowdStrike, which assisted, is a security vendor with products in this area, and its page carries a free-trial banner. Its post also says the disruption will have a limited effect, which is against its interest, and both facts are on the page. The Texas office's headline uses "dismantles" where the body of its own release says "disrupted".

What the indictment alleges each control missed, and what caught something

The indictment is a rare public record of controls meeting a scheme. It is allegations only, and it lists victim companies by number, so what each company did is thin. Read for what a defender can use, it shows controls that failed on their own and controls that produced a signal.

Controls, what the FBI and the indictment record as going around them, and what the record shows caught something. Paragraph numbers are the indictment's.

The control	What went around it	What caught something
Video interview and onboarding	Two different individuals under one identity, at interview and at onboarding (paras 140, 143). The FBI says actors pay Americans to appear on camera.	The FBI: capture images for comparison with later meetings, because "Sometimes an individual is employed to pass the initial interview, but the on-the-job work is completed by a different individual" (July 2025).
Equipment sent to the ID address	The identity, name and address were the facilitator's own, with another person behind the identity (paras 142, 143).	The record does not say how any company noticed. The FBI and the 2022 advisory say to treat a request for another address as a flag.
Endpoint policy on remote software	Remote desktop software on company laptops, in the indictment and the FBI's account. The FBI adds that actors use remote-control hardware and separate laptops, so a software inventory alone will not show them (inference).	Two companies. One asked questions about "prohibited software" two days after remote software went on a new laptop (paras 145, 146, derived). One ended a worker's employment two days after an attempt to attach a remote device "in violation of" its policies, following excuses to avoid meetings (paras 161, 162, derived).
Sign-in and second-factor logs	At one company, second-factor prompts were accepted about 95 per cent of the time from one address that resolves to China (para 134).	The signal was in the log. The indictment does not say whether anyone acted on it.
Payroll and bank checks	Paper payroll cheques in persona names were mailed to a facilitator's address and deposited into the facilitator's account on deposit authorisations in fictitious names (paras 359 to 362). A persona repeatedly changed direct-deposit details (para 189). A shell company described its business to a bank as "A remote service company, where people send laptops and they are kept operational and connected" (para 363).	The FBI and the 31 July 2026 joint alert list the account signals: a payee name that does not match the employee, frequent bank changes, a third party's account, and requests for cryptocurrency.
A step late in the lifecycle	A persona passed hiring and ran for over a year.	When one company's paperwork asked for a persona's fingerprints, the group is alleged to have stopped using that persona (para 108).
Contractor and staffing chains	CrowdStrike reports intermediaries letting end-client devices be redirected "without the staffing firm's knowledge". The FBI says actors subcontract "entire jobs".	The FBI (January 2025): "Verify third-party staffing firms conduct robust hiring practices and routinely audit those practices."

The UK: what the record says about UK firms, and what UK rules ask of an employer

No UK company is named or counted in the documents above. The UK's published position is older and describes a different picture, freelancers who present as third-country nationals, and it gives no figure for UK victims. A Google Threat Intelligence Group report of 1 April 2025 says it observed DPRK IT worker projects in the UK and one case in which facilitators in the US and the UK were used, with a corporate laptop meant for New York found working in London. The same report assesses that US awareness, indictments and "right-to-work verification challenges" pushed operations towards Europe. That is a vendor's assessment and it gives no count. No National Crime Agency publication on North Korean IT workers was found; the National Cyber Security Centre and the Office of Financial Sanctions Implementation (OFSI) have published, and the table sets out what each says.

UK material as read on 14 October 2026 from gov.uk, ncsc.gov.uk, npsa.gov.uk, ico.org.uk and parliament.uk, with where each stops. Quotations are short and exact.

UK source	What it says, as read	Where it stops
OFSI advisory on North Korean IT workers, 12 September 2024	"It is almost certain that UK firms are currently being targeted". Red flags that "should trigger increased due diligence", especially "when two or more are present". Mitigations for UK firms include video interviews, pre-employment background checks, flagging equipment that cannot go to the ID address, monitoring the IP addresses of remote workers, avoiding cryptocurrency pay, and need-to-know access.	Written in September 2024. It describes laptop farms in one line and a threat of freelancers posing as third-country workers. It is not legal advice.
NCSC Annual Review 2025 (1 September 2024 to 31 August 2025)	"UK firms are almost certainly being targeted by IT workers from the DPRK", presenting as freelance third-country staff, to "generate revenue for the DPRK regime".	No count of UK victims and no employer controls.
Joint alert, 31 July 2026, issued with the UK's Foreign, Commonwealth and Development Office and OFSI	Red flags for hiring: photo ID mismatch or manipulated video, refusal to join video calls, signs of several people operating one account, requests for cryptocurrency pay.	An alert, not law. No UK case figures.
Two Home Office written answers, 16 September 2025	Asked what estimate the government had of unwitting employment of hoax remote workers by UK firms, the answer points to the OFSI advisory and says OFSI will "take robust, proportionate action".	Gives no estimate.
NPSA insider risk guidance (updated 28 July 2026), employment screening (7 November 2025) and remote working (25 February 2023)	Screening "should be applied to all individuals who are provided access to organisational assets including permanent, temporary and contract workers". Pre-employment screening "verifies the credentials of job applicants" and points to gov.uk guidance on examining identity documents.	The remote working page covers lost equipment, supervision and isolation. It does not mention impostor workers or sanctions.
Home Office employer's guide to right to work checks, 1 October 2026	The employer must be satisfied that "the individual whose right to work is being checked is the same individual who will be carrying out the work". From 1 October 2026 the scheme reaches worker contracts, individual sub-contractors and online matching services, with substitution controls and identity verification systems; re-verification "at least once in any 24-hour period or shift" is recommended. The contractual label "will not, by itself, determine" responsibility.	The guide "is not intended to apply to" arrangements "where the work or services are not carried out in the UK". It is about illegal working, not North Korea or sanctions.
OFSI monetary penalties guidance (updated 9 February 2026)	A civil penalty needs no proof that the person knew or had reasonable cause to suspect a breach, for breaches on or after 15 June 2022. The maximum is the greater of 1,000,000 pounds or 50 per cent of the estimated value. A breach may be a criminal offence with up to 7 years in prison. Knowledge becomes a "case factor". Voluntary disclosure can earn a discount of up to 30 per cent.	OFSI's advisory says employing or paying these workers "could be" a breach. Whether it is depends on who receives the funds. OFSI's published enforcement list (updated 2 September 2026) has no mention of Korea.
ICO guidance on monitoring workers	"Worker" covers any contract type, and homeworking is covered. A data protection impact assessment is required before high-risk processing, including biometric data of workers. Biometric recognition means special category data. Covert monitoring is only for exceptional cases. The guidance is "under review" after the Data (Use and Access) Act.	Not written for identity fraud. It sets the limits within which an employer monitors, it does not forbid it.

The UK points are these. A right to work check, as the Home Office guide reads, asks for continuity between the person checked and the person working, and it applies only to work done in the UK. A developer who is really abroad is outside it, and sanctions law applies regardless of where they are. OFSI's advisory names three DPRK bodies designated under the UK's DPRK regulations and says employing or paying these workers "could be" a breach, directly or indirectly. Whether a given payment is one depends on who ultimately receives the funds, which an employer cannot see; that is the sanctions case for knowing who the worker is (inference). OFSI's advisory dates from September 2024 and predates the facilitator and subcontracting patterns the FBI describes in October 2026. And monitoring a home worker's device is lawful only within the ICO's limits, so the choice of control is partly a data protection decision.

What to do, in the order worth doing

Every item below comes from a primary named above. None needs a vendor product and none is a guarantee: the FBI says these workers "cannot be identified reliably with a single indicator".

What could not be verified

• The indictment. It is a scanned PDF. All 58 pages were read by optical character recognition, and pages 3, 5, 13 and 55 were checked by eye. Two defendants' names are redacted in the document.
• The Texas orders. The Texas office attached an application and an order under 18 U.S.C. 2703(d) to Google. The application was read; the order was not. They concern account records, not charges.
• Everything the press adds. The five news stories were read for counts. Nothing in them was relied on where a primary speaks.
• CrowdStrike. Its post is a vendor's own account of its assistance. Nothing independent confirms the number of farms it says were disrupted "across the U.S.".
• Companies, workers and UK victims. Not stated in any document read.
• UK material not obtained. No National Crime Agency or NCSC publication specific to these workers was found in searches of their sites. The NPSA contract staff page returned an access error and was not read. OFSI's January 2026 enforcement note timed out and was not read.
• UK sanctions list. Whether any defendant or entity is on the UK sanctions list was not checked, because that needs the defendants' names, which this briefing does not use.
• The court docket. No public docket for the case was found, so no filing after the indictment was read. The defendants' initial appearances were described as "in the near future".
• Time-stamped. Read between 19:05 and 19:40 BST on 14 October 2026. A docket entry, a further release or a new alert could change a statement within hours.

The question that exposes the gap

If the person who passed your interview is not the person at the keyboard today, which control you operate would tell you, and how soon?

Key facts