Nigerian Man Gets 8 Years for Hacking Tax Firms, Fraud; $10.8M Forfeiture Ordered

Chukwuemeka Victor Amachukwu, a Nigerian national, was sentenced to eight years in federal prison for orchestrating a multi-year campaign of hacking, tax fraud and identity theft. The Justice Department announced the sentencing, which concludes a legal process that began with his arrest in France in July 2023 and extradition to the United States in August 2025.

What happened

The defendant enriched himself from 2019 to 2023 by targeting US-based tax preparation businesses, according to court records reviewed by CyberScoop. Amachukwu and his co-conspirators hacked into firms located in New York, Texas and other states to steal the tax and personal data of at least 800 business customers. They used this stolen information to file false tax returns with federal and state authorities.

In addition to tax fraud, the group enticed victims to send money for investment schemes that did not exist. Prosecutors stated that Amachukwu and his associates obtained more than $7 million through these fraudulent investment schemes. They also secured approximately $2.5 million via fraudulent tax returns and $819,000 in payouts from the Small Business Administration’s Economic Injury Disaster Loan program.

One specific attack vector involved a spearphishing email sent in May 2021 to an employee of a New York-based tax preparation business. This email infected the firm’s computer systems with malware, providing the attackers with access to sensitive client data. Amachukwu pleaded guilty in April to conspiracy to commit computer intrusions and conspiracy to commit wire fraud.

Why it matters

The scale of the financial harm underscores the risk tax preparation firms pose as high-value targets for identity theft. The defendant ordered to pay nearly $3.65 million in restitution to victims and forfeit almost $10.85 million. These penalties reflect the extensive damage inflicted on both individual victims and public resources through the misuse of stolen identities.

The international nature of the operation highlights the challenges in tracking cybercriminals who operate offshore. Amachukwu believed he was safe while targeting victims from abroad, but coordinated efforts by the FBI, the Justice Department’s Office of International Affairs and the U.S. Marshals Service led to his capture. This case demonstrates that extraterritorial operations do not guarantee immunity from US prosecution.

Our take on the response

• Monitor email gateways for spearphishing attempts targeting finance and tax sector employees.
• Implement strict access controls to limit the movement of sensitive personal and tax data.
• Conduct regular audits of third-party vendor access to ensure security standards are maintained.
• Train staff to recognize social engineering tactics used to deploy malware on corporate systems.

What defenders should look for

Teams should monitor for unusual outbound connections from workstations that handle sensitive client data, as malware often communicates with command-and-control servers. Check for unexpected privilege escalations or new administrative accounts created shortly after a user opens an email attachment. Look for anomalies in file access patterns, particularly when tax forms or identity documents are accessed outside of normal business hours. Investigate any sudden spikes in email traffic originating from internal accounts, which may indicate compromised credentials being used to spread malware or exfiltrate data.

Background: Social engineering

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It relies on trust, urgency, and authority to bypass security controls. Defenses require verifying identity through out-of-band channels and validating requests against established procedures.

Read the full guide: Social Engineering Explained: How Manipulation Bypasses Security

What to do and how to stay safe: Chukwuemeka Victor Amachukwu

• Review email security logs for phishing indicators targeting finance and tax departments.
• Verify that endpoint detection tools are actively monitoring for malware execution on critical systems.
• Ensure that multi-factor authentication is enforced for all remote access and privileged accounts.
• Validate that data loss prevention policies are blocking unauthorized transfers of personal information.

Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who was sentenced in this case and what was the sentence?

Chukwuemeka Victor Amachukwu was sentenced to eight years in prison by US District Judge Paul G. Gardephe.

What specific crimes did the defendant plead guilty to?

He pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud.

How much money was the defendant ordered to pay in restitution and forfeiture?

The court ordered nearly $3.65 million in restitution and a forfeiture of almost $10.85 million.