Federal judge in Boston orders restitution as prosecutors detail five-year cyberattack that targeted US tax firms and stole taxpayers’ identities.

A United States federal court in Boston has sentenced Nigerian national Matthew A. Akande to eight years in prison for masterminding a sophisticated cyber fraud operation that targeted tax preparation firms and defrauded the US government of more than $1.3 million.

Akande, 37, was also ordered to pay $1,393,230 in restitution and will serve three years of supervised release after completing his prison term. The sentence was handed down on Tuesday by US District Judge Indira Talwani, according to a statement released by US authorities on Wednesday.

Prosecutors said Akande ran an international cybercrime network that used phishing emails, malware attacks, and identity theft to infiltrate the computer systems of Massachusetts-based tax preparation companies. The scheme operated between June 2016 and June 2021, during which Akande and his accomplices filed over 1,000 fraudulent tax returns.

Court records show the group attempted to claim more than $8.1 million in tax refunds, with at least $1.3 million successfully paid out by the US government.

According to investigators, the fraud began with deceptive emails sent to tax firms, posing as prospective clients seeking tax services. The emails tricked employees into installing remote-access trojan (RAT) malware, including a tool known as Warzone RAT, which gave the criminals unauthorized access to sensitive systems.

Once inside, Akande’s network harvested personally identifiable information (PII) and prior-year tax data belonging to unsuspecting taxpayers. The stolen information was then used to file fraudulent returns, with refunds routed to bank accounts opened by co-conspirators in the United States.

Authorities said portions of the stolen funds were later transferred to third parties in Mexico, where Akande was based, while other proceeds were retained by members of the network.

Akande was arrested in October 2024 at London’s Heathrow Airport following a request by US authorities. He was extradited to the United States on March 5, 2025, after being indicted in July 2022 on multiple charges, including conspiracy, wire fraud, unauthorized access to protected computers, theft of government funds, and aggravated identity theft.

The US Department of Justice described the case as a major example of cross-border cyber-enabled tax fraud, warning that such schemes pose growing risks to government systems and individual taxpayers.

Judge Talwani noted that while the crimes were serious and financially damaging, the absence of physical harm influenced the court’s sentencing decision.

Federal authorities said the conviction sends a strong warning to cybercriminals operating across borders and underscored the importance of international cooperation in combating digital financial crimes.

The Justice Department also urged tax firms and financial institutions to strengthen cybersecurity defenses, including employee training and advanced monitoring systems, to prevent similar attacks in the future.

Akande will remain in federal custody and begin his supervised release after serving his prison sentence, during which he will face strict financial and monitoring restrictions.