Nigerian national sentenced to eight years in New York for spearphishing US tax-preparation firms from 2019 to 2021, stealing data on at least 800 clients and filing fraudulent tax refund and disaster-loan claims worth more than US$3 million
Chukwuemeka Victor Amachukwu, 40, was sentenced in the US District Court for the Southern District of New York to eight years in prison, US Attorney Jamie McDonald announced on 19 October 2026, according to BleepingComputer's report of the press release. He had pleaded guilty to conspiracy to commit computer intrusions and wire fraud after extradition from France in August 2025. With co-defendant Kingsley Uchelue Utulu and other co-conspirators, he sent spearphishing emails to tax-preparation businesses in New York, Texas and other states between 2019 and 2021, got into their computers and took tax and personal data on at least 800 of their clients. The group used it to file for about US$8.4 million in refunds with the IRS and state tax agencies, receiving about US$2.5 million, and obtained about US$819,000 through fraudulent Economic Injury Disaster Loan applications. He was also involved in a fake investment scheme that took more than US$7 million. The court ordered US$3.6 million in restitution and forfeiture of nearly US$11 million. Primary: SDNY press release (our fetch was blocked by the site's bot check, so details are as reported by BleepingComputer, 20 Oct).
- Product
- US tax-preparation businesses (spearphishing and remote access to office computers)
- Versions
- n/a — criminal case; intrusions 2019 to 2021
- Exploited in Australia?
- unknown
- Patch to
- Accounting and tax practices are a standing target in tax season: require phishing-resistant MFA for email and practice software, block macro and remote-access attachments, verify new-client documents out of band, and limit how much client tax file and ID data sits on staff PCs. Australian practices that lose client tax data should notify the ATO and check NDB obligations; see /knowledge/ndb-clock.
Primary: US Attorney's Office SDNY — Nigerian man sentenced to eight years for hacking, fraud and identity theft schemes (19 Oct 2026) · BleepingComputer — Hacker gets 8 years for stealing $3.3 million from taxpayers (20 Oct 2026)