Bottom line: A security vendor’s data suggests fraudulent North Korean IT-worker applicants are reaching onboarding activity (offer letters, background checks, equipment requests or first-day IT setup), and that in some of the organizations it examined, large volumes of sensitive files were widely shared. The data is one vendor’s account and is not independently verified, but the control questions it raises are sound.
What was reported
Material Security published “A Thousand Masks” on 10 November 2026 (author Belem Regalado), reported by Help Net Security on 13 November. Over 12 months the company counted:
- 2,429 suspected DPRK personas in applications across its customer base
- 1,100 that reached interview stage or later
- 27 that reached “onboarding activity” (offer letters, background checks, equipment requests or first-day IT setup); “roughly one in 90” is our arithmetic
- 41% appearing at more than one organization; 15 at ten or more, one at 19
- 18 of the 27 in process at other employers at the same time
In the last 30 days, 232 personas contacted 99 organizations; at 42 of them a persona reached interview or offer, and at 4 it reached onboarding activity.
The exposure finding
Material profiled four organizations where a persona reached onboarding activity. Its percentages are the share of each data type “shared company-wide or by public link”. The four differed widely:
- Organization 1: about 15 million source-code files and about 130,000 flagged with bank or routing numbers, held closely, shared with almost no one beyond their owners.
- Organization 2: about 400,000 files flagged as containing Social Security numbers and 345,000 with bank or routing numbers. Material says 68% of the SSN files (about 277,000) and 71% of the bank or routing files (about 248,000) were shared company-wide or by public link, reachable by any account inside the organization.
- Organization 3: about 14 million source-code files, roughly 1,900 shared by public link.
- Organization 4: about 1.5 million source-code files; about 21% of its financial files and 17% of its credit-card files shared beyond their owners.
Organization 2 is the clearest case; Organization 4 also had about 21% of financial files shared beyond owners. One case does not generalize to the other three.
Note what this does and does not show. Broad sharing is a pre-existing data-governance weakness that a new hire, genuine or not, inherits. The report does not say these files were accessed or stolen by the personas.
Limits of the evidence
- Single source. We found the figures only in Material’s own publication and the coverage of it.
- Attribution method not explained. The report, as we read it, does not describe how personas were attributed to North Korea or how files were classified. Treat the counts as indicative, not audited.
- Vendor interest. The vendor sells data-security tooling; that is not a reason to dismiss the data, but it is a reason to ask for method before citing it to your board.
Our assessment: what to ask
- Who owns the intersection of HR, recruiting and security? Material recommends joining recruiting and threat-intelligence signals. Ask whether a suspicious applicant flag can reach security before an offer.
- How strong is identity verification at hiring? Background checks that confirm a person exists do not confirm that the person on video is the person who will work. Ask what is verified, and when.
- Is scrutiny staged by risk? Material suggests triage by hiring stage. Roles with access to code, finance or customer data warrant more.
- Does review continue after onboarding? Material recommends continuing review after the start date.
- Who can see what on day one? The exposure data points at least as much to over-shared files as to hiring. Mapping data access by role reduces the damage from any bad hire, including a legitimate insider.
Decision for leaders
Commission a short review jointly owned by HR and security: confirm how identity is verified for remote hires, and measure how much sensitive data is shared company-wide. The second measure is useful whatever the truth about DPRK applicants.