The 2026 Verizon DBIR confirms it: your TA team is the first line of defence against state-backed employment fraud
The News
The 2026 Verizon Data Breach Investigations Report dedicates an entire section to North Korean IT workers — operatives who apply for legitimate remote roles, pass interviews, clear background checks, and then perform the work through laptop farms run by local accomplices. The entry point, as threat intelligence firm Nisos emphasises, is not the corporate firewall. "It's your job posting. It's your recruiter's inbox. It's your interview process," writes Dutch Schwartz at Nisos. Technology and SaaS companies are the most heavily targeted sectors, but the report warns that this is not a tech industry problem — it is a remote employment problem that will expand to any organisation hiring remotely.
The sobering detail: these workers often perform well. "Some of them are not collecting a paycheck and coasting," Schwartz notes. "Some of them are your top performers." The identity fraud is not a red flag visible in a performance review. The signals are in the broader digital footprint — inconsistencies across public sources, anomalies in identity history, patterns of one person appearing to hold multiple full-time roles simultaneously. Standard background checks verify that an identity exists, not that the person presenting it is who they claim to be.
The DBIR also reports that the human element is present in 62% of breaches, and DPRK IT workers represent one of the clearest examples of organised, state-backed human risk. "The first line of defence against a North Korean IT worker isn't your CISO," Schwartz writes. "It is your talent acquisition team. That's the shift most organisations haven't made yet."
Why It Matters
For TA leaders, this reframes a security problem as a talent acquisition process problem. If your pre-employment vetting relies on standard background checks — criminal history, right to work, reference verification — you are using tools designed to answer a different question. They verify whether an identity exists in official records. They do not verify whether the person sitting in the video interview is the same person who owns that identity, or whether that identity has been manufactured for the purpose of employment fraud.
The practical implication is uncomfortable: many organisations' hiring processes contain a gap that state-backed actors have learned to exploit, and closing that gap requires closer collaboration between TA and security teams than exists in most enterprises today. The companies that have been breached by this method were not obviously negligent — they were using standard industry practices that are now demonstrably insufficient for the threat landscape.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your chief information security officer (CISO) — share page 73 of the 2026 Verizon DBIR and ask whether your organisation's pre-employment screening programme includes identity verification that goes beyond right-to-work checks to detect synthetic identities, employment history anomalies, and remote work fraud patterns.
Your head of talent acquisition operations — review whether your background check provider offers identity verification that validates the person behind the identity (e.g., biometric verification, live document checks) rather than only confirming the identity's existence in databases.
Your procurement lead for background screening services — ask your current provider how they differentiate between identity verification and identity existence checks, and request a written summary of their capabilities for detecting synthetic identities and organised employment fraud.
Inspect
What to take a closer look at
Run a spot check of your last 50 remote hires: cross-reference their claimed employment history against public sources (LinkedIn, Companies House, professional registrations) and look for inconsistencies — overlapping full-time roles, implausible career timelines, professional histories that don't match public records. Specific tool to look at: Your background check provider's audit trail — specifically, whether they perform social media and digital footprint analysis as part of their standard package, or whether that is an add-on you may not have enabled.
Reflect
What to think about more deeply
The most interesting question isn't "how do we stop North Korean IT workers?" — it's "if our hiring process is porous enough that a state-backed operative can pass through it undetected while performing the job adequately, what does that say about the depth of assessment we're applying to every candidate, and how many other motivated fabricators — not state-backed, just ambitious — have we already hired?"