Tax Firm Hacker Sentenced for Identity Theft and Fraud Scheme

The malicious campaign targeted US-based tax preparation businesses, using malware to breach systems and steal sensitive client data. According to court records, Amachukwu enriched himself by hacking into these businesses, filing false tax returns, and enticing victims to send money for non-existent investments. This combination of intrusion and financial fraud caused widespread harm to the affected organizations and their clients. The operation involved multiple co-conspirators based in Nigeria.

How did the attackers gain access?

In one documented attack in May 2021, the conspiracy used a spearphishing email sent to an employee of a New York tax firm. This message infected the company’s computer systems with malware, granting the attackers initial access. Once inside, they harvested tax and personal data from at least 800 business customers. The victims were located in New York, Texas, and other regions. This initial compromise provided the group with the stolen identity information needed to commit further fraud.

What were the financial consequences?

The scheme generated millions in illicit gains. Prosecutors stated the group obtained more than $7 million through fraudulent investment schemes. They also secured about $2.5 million in fraudulent tax returns and $819,000 in payouts from the Small Business Administration’s Economic Injury Disaster Loan program. A federal judge ordered Amachukwu to pay nearly $3.65 million in restitution to victims. Additionally, the court ordered the forfeiture of almost $10.85 million. These penalties reflect the scale of the financial damage inflicted on the victims and the public.

Who was held accountable?

Chukwuemeka Victor Amachukwu, also known as Chukwuemeka Victor Eletuo and So Kwan Leung, pleaded guilty in April to conspiracy to commit computer intrusions and wire fraud. He was arrested in France in July 2023 and extradited to the United States in August 2025. US District Judge Paul G. Gardephe sentenced him to eight years in prison. The investigation involved the FBI, the Justice Department’s Office of International Affairs, and the U.S. Marshals Service. His alleged co-conspirators, including Kingsley Uchelue Utulu, were also part of the Nigeria-based network.

What does this mean for security teams?

This case highlights the persistent risk to service providers handling sensitive client data. Tax preparers are high-value targets because they aggregate personal and financial information. The use of spearphishing to deliver malware remains a common initial access vector. Organizations must assume that attackers will attempt to steal identities for both tax fraud and investment scams. The scope of the data theft indicates that attackers can extract significant volumes of information once they breach a single endpoint.

What analysts watch for

Security teams usually examine email gateways for spearphishing attempts that target specific employees with high privileges. Analysts check for unusual outbound traffic from workstations that may indicate data exfiltration or command-and-control communication. They also monitor for the creation of new user accounts or changes to file permissions, which often signal persistence mechanisms. Reviewing logs for failed login attempts from unexpected geographic locations helps identify early intrusion signs. Teams should verify that backup systems are isolated and immutable to prevent ransomware or data theft from compromising recovery options.

What to do and how to stay safe: tax fraud

• Monitor email logs for suspicious attachments or links sent to employees with access to client databases.
• Implement multi-factor authentication on all systems that store personal or financial information to prevent credential theft.
• Conduct regular audits of user access rights to ensure only necessary personnel can view sensitive tax data.
• Once the vendor provides an update, apply patches promptly to close known vulnerabilities in endpoint protection software.

Step-by-step guide: Build an Incident Response Plan That Actually Works

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many victims were affected by this hacking scheme?

Court records indicate that the attackers stole tax and personal data from at least 800 business customers.

What specific charges did the defendant plead guilty to?

Chukwuemeka Victor Amachukwu pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud.

How much money was ordered to be forfeited?

The federal judge ordered the forfeiture of almost $10.85 million in addition to restitution payments.