A hacker has been extradited to the United States for his involvement in tax fraud schemes that resulted in the theft of more than $2.5 million.

A sophisticated cybercriminal operation targeting American tax preparation businesses has led to the extradition of Nigerian national Chukwuemeka Victor Amachukwu from France to face federal charges in New York. The 39-year-old defendant, who operated under multiple aliases including “Chukwuemeka Victor Eletuo” and “So Kwan Leung,” orchestrated a multi-year scheme beginning in 2019 that compromised electronic systems of tax businesses across New York, Texas, and other states. The attack methodology relied on carefully crafted spearphishing emails designed to deceive employees of tax preparation companies into providing system access credentials. Once inside the corporate networks, Amachukwu and his co-conspirators, including Kingsley Uchelue Utulu, systematically extracted sensitive customer data, including Social Security numbers, addresses, and financial information from thousands of taxpayers. This harvested personally identifiable information became the foundation for an elaborate fraud operation targeting both federal and state tax authorities.

The U.S. Attorney’s Office, Southern District of New York, identified that the criminal network successfully filed fraudulent tax returns seeking approximately $8.4 million in refunds, ultimately obtaining $2.5 million from the Internal Revenue Service and various state tax agencies. The operation expanded beyond traditional tax fraud to exploit the Small Business Administration’s Economic Injury Disaster Loan program, netting an additional $819,000 in fraudulent payouts. The spearphishing attack vector employed by Amachukwu’s network demonstrated sophisticated social engineering principles combined with technical exploitation methods. Malicious emails likely contained embedded links or attachments designed to harvest login credentials through credential phishing pages or deploy remote access trojans for persistent network access. The attackers maintained prolonged access to multiple tax preparation systems across different states, suggesting the use of advanced persistent threat techniques, including backdoor access points and legitimate administrative tools for malicious purposes.