A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019.
40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025.
"Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release.
"Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
According to court documents, Amachukwu and his accomplices stole more than $3 million after filing fraudulent tax and loan applications with the Internal Revenue Service and state tax authorities using their victims' stolen personal data.
Together with co-defendant Kingsley Uchelue Utulu and other Nigerian co-conspirators, Amachukwu launched spearphishing attacks against tax preparation businesses in New York, Texas, and other US states between 2019 and 2021, gaining unauthorized access to their targets' computers and stealing the tax and personally identifiable information (PII) of at least 800 customers.
In total, he allegedly obtained about $2.5 million in fraudulent tax refunds (after filing for $8.4 million in refunds) and another $819,000 through fraudulent loan applications with the Small Business Administration's Economic Injury Disaster Loan program.
Amachukwu was also involved in a fake investment scheme that offered potential US victims investments in what the scammers described as valuable standby letters of credit. However, these investments did not exist, and the fraudsters stole more than $7 million from multiple victims.
In addition to the prison term, the court sentenced Amachukwu to one year of supervised release and ordered him to pay $3.6 million in restitution and forfeit nearly $11 million.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.