Suspected North Korean IT workers reached onboarding at companies with open data

Over a one-year period, 27 suspected North Korean personas successfully navigated the hiring process to reach the onboarding stage at real companies, with one gaining access to approximately 277,000 files containing Social Security numbers. The core failure was treating a newly hired remote employee as an immediately trusted insider without validating their true identity or limiting their initial access to only what was necessary for their role. Files containing sensitive PII should never be shared company-wide or via open public links, as this dramatically amplifies the damage any malicious insider—fake or otherwise—can cause. This incident highlights that the hiring pipeline itself is an attack surface, and that identity verification, least-privilege access provisioning, and data governance must be treated as security controls, not HR formalities.