The US Attorney's Office for the Southern District of New York announced on Oct 19 that Chukwuemeka Victor Amachukwu (aka "Chukwuemeka Victor Eletuo", "So Kwan Leung"), 40, was sentenced by Judge Paul G. Gardephe to eight years in prison after pleading guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud. From at least 2019, he, co-conspirator Kingsley Uchelue Utulu and other Nigeria-based conspirators used spear-phishing emails to break into US tax-preparation businesses in New York, Texas and other states, stealing tax and identity data on at least about 800 customers. They filed fraudulent federal and state returns seeking at least about $8.4 million in refunds and got at least about $2.5 million, plus about $819,000 in fraudulent SBA disaster-loan (EIDL) payouts. Separately, he ran a fake standby-letter-of-credit investment scheme that netted more than $7 million. He was ordered to pay $3,647,629.39 in restitution and forfeit $10,846,634.39. BleepingComputer reports he was extradited from France in August 2025.

Takeaway for small firms: tax preparers are a standing target every filing season. The IRS requires them to have a written information security plan, and MFA on email and tax software is the control that most often breaks this kind of intrusion.