Chukwuemeka Amachukwu, a Nigerian national extradited from France, was sentenced to eight years in federal prison for his role in spearphishing attacks on US tax preparation businesses. The sentence, handed down by U.S. District Judge Paul Gardephe, also includes one year of supervised release and an order to pay restitution of more than $3.6 million. Both Recorded Future News and BleepingComputer report the eight-year term, though BleepingComputer's headline cites $3.3 million in taxpayer losses, a figure that appears to differ from the restitution amount in court documents.
Prosecutors said Amachukwu led a group that used spearphishing emails to breach tax preparation firms dating back to 2019. In one May 2021 incident, the group sent a phishing email to an employee of a Manhattan-based tax business, infected the company with malware, and stole customer tax information. They used the stolen data to file fraudulent state and federal tax returns, attempting to obtain about $8.4 million in refunds and ultimately succeeding in getting $2.5 million. The group also filed fraudulent claims with the Small Business Administration's Economic Injury Disaster Loan program, netting about $819,000.
Beyond the tax scheme, Amachukwu earned more than $7 million by impersonating wealthy overseas businessmen and offering fake standby letters of credit to US victims. His co-conspirator, Kingsley Uchelue Utulu, was arrested in the UK and sentenced to five years in prison in June. U.S. Attorney Jamie McDonald said the crimes imposed significant harm on victims and the public, making the substantial sentence appropriate.