Hacker gets 8 years for stealing $3.3 million from taxpayers

Chukwuemeka Victor Amachukwu, a Nigerian national, was involved in spearphishing campaigns targeting US tax preparation firms across multiple states between 2019 and 2021. These attacks enabled unauthorized access to victim computers, resulting in the theft of personally identifiable information and tax data of at least 800 customers. Using this stolen data, Amachukwu and co-conspirators filed fraudulent tax refund claims amounting to $8.4 million, of which approximately $2.5 million was obtained, and secured $819,000 through fraudulent loan applications with the SBA's Economic Injury Disaster Loan program. Additionally, Amachukwu engaged in a fraudulent investment scheme involving fake standby letters of credit, defrauding victims of over $7 million. After extradition from France, he pleaded guilty to conspiracy charges and was sentenced to eight years imprisonment, one year supervised release, and ordered to pay $3.6 million restitution and forfeit nearly $11 million.

The spearphishing attacks led to significant financial losses exceeding $3.3 million through fraudulent tax refunds and loan applications. The fraudulent investment scheme caused additional losses of over $7 million. The attacks compromised sensitive personal and tax information of at least 800 individuals, causing harm to victims and public trust in tax preparation services. The defendant's conviction and sentencing demonstrate law enforcement's ability to hold cybercriminals accountable.

This report describes a criminal case and does not provide specific technical mitigation steps. However, organizations should continue to implement strong email security controls to defend against spearphishing, including user training, multi-factor authentication, and monitoring for unauthorized access. Since the attacks occurred between 2019 and 2021, affected organizations should verify that any vulnerabilities exploited have been addressed. No official patch or fix is applicable as this is a criminal incident rather than a software vulnerability.