What to do if your company discovers a North Korean worker in its ranks

Experts at Google’s Cyber Defense Summit outlined how North Korean IT workers infiltrate companies to generate revenue for the DPRK, emphasizing HR-driven detection signals (e.g., mismatched identities, recycled resumes, reluctance to use video), strict U.S. sanctions liabilities, and strategic response practices like maintaining cooperative communication to recover devices and evidence. The article highlights the value of early FBI engagement and voluntary OFAC self-disclosure, and urges organizations to exercise and refine cross-functional playbooks that include HR, legal, and security for these nontraditional “cyber” cases.