Material tracked 2,429 suspected DPRK IT-worker personas over 12 months, including 1,100 that reached interviews or later stages and 27 that progressed to onboarding activity. Forty-one percent appeared at multiple organizations, demonstrating systematic reuse of fabricated identities across parallel hiring pipelines. Four recent onboarding cases exposed sharply different potential blast radii, ranging from tightly restricted data to hundreds of thousands of identity and financial files shared company-wide or publicly. The findings frame DPRK fraudulent hiring as an insider threat requiring both applicant verification and strict control of newly provisioned accounts and sensitive-data access.