Nigerian hacker sentenced to eight years for tax firm breaches and fraud

U.S. District Judge Paul Gardephe sentenced Nigerian national Chukwuemeka Amachukwu to eight years in federal prison this week. The judge also ordered one year of supervised release and mandated Amachukwu pay more than $3.6 million in restitution for crimes involving tax preparation business breaches.

According to The Record, Amachukwu pleaded guilty to multiple charges including fraud, hacking, and identity theft. He was extradited from France last year to face these U.S. charges. Prosecutors stated that Amachukwu led a group responsible for sophisticated schemes targeting U.S. businesses, resulting in significant harm to victims and the public.

Criminal Scheme Details

Court documents indicate Amachukwu collaborated with Kingsley Uchelue Utulu and other hackers based in Nigeria. The group used spearphishing emails to breach tax preparation businesses, with attacks dating back to 2019. They successfully infiltrated systems to steal sensitive information belonging to approximately 800 business customers.

One specific incident occurred in May 2021, when the attackers sent a phishing email to an employee at a Manhattan-based tax firm. This action infected the company with malware, allowing the group to steal customer tax data. They subsequently used this information to file fraudulent state and federal tax returns.

The group attempted to obtain about $8.4 million in tax refunds through these fraudulent filings. They ultimately succeeded in securing $2.5 million. Additionally, the hackers used the stolen data to file claims with the Small Business Administration’s Economic Injury Disaster Loan program, earning roughly $819,000 in fraudulent payouts.

Additional Fraud Activities

Beyond the tax-related crimes, Amachukwu engaged in other fraud schemes that generated millions in illicit gains. According to the source material, he earned more than $7 million by impersonating wealthy overseas businessmen. He offered fake standby letters of credit to U.S. victims as part of these separate fraudulent operations.

In June, co-conspirator Kingsley Uchelue Utulu was sentenced to five years in prison for his role in the scheme. Utulu was arrested in the United Kingdom prior to his sentencing. U.S. Attorney Jamie McDonald noted that the significant sentence for Amachukwu was appropriate given the harm imposed on victims.

What should you do?

Security professionals should monitor for spearphishing attempts targeting financial and tax preparation sectors. Organizations must verify the legitimacy of large financial transactions or loan applications, especially those involving recently breached data.

What to do and how to stay safe: Chukwuemeka Amachukwu

• Implement strict email filtering and user training to detect spearphishing attempts targeting sensitive industries.
• Monitor for anomalous tax filings or loan applications that may indicate the use of stolen identity data.
• Ensure robust endpoint protection is active to detect and contain malware delivered via malicious email attachments.
• Verify the authenticity of high-value financial instruments such as standby letters of credit through direct contact with issuing banks.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much restitution was Chukwuemeka Amachukwu ordered to pay?

He was ordered to pay more than $3.6 million in restitution as part of his sentence.

What was the total amount of fraudulent tax refunds the group attempted to obtain?

The group tried to get about $8.4 million in tax refunds, successfully obtaining $2.5 million.

Where was Chukwuemeka Amachukwu extradited from to face U.S. charges?

He was extradited from France last year on fraud, hacking, and identity theft charges.