DOJ Watch is The Investigative Journal’s daily review of federal enforcement activity, drawn from Department of Justice press releases, charging documents, and related public records. Charges described below are allegations unless a guilty plea, conviction, or sentence is noted. Defendants who have not resolved their cases are presumed innocent.
The Justice Department closed out June 2026 with one of the largest coordinated fraud actions in its history, a guilty plea from a former White House national security adviser, and a string of cases spanning transnational cybercrime, domestic terrorism, intellectual-property theft, and tax fraud. This edition reviews seven enforcement actions announced between June 23 and June 26, with links to the underlying DOJ records.
1. Record $6.5 billion health care fraud takedown charges 455
On June 23, the Justice Department announced the 2026 National Health Care Fraud Takedown, which it described as the largest coordinated health care fraud enforcement action in the Department’s history. According to the DOJ announcement, 455 defendants — including 90 doctors and other licensed medical professionals — were charged in connection with schemes involving more than $6.5 billion in alleged false claims. The cases span 56 federal districts and 45 states and territories, and the Department says 50 state Medicaid Fraud Control Units participated, the most ever.
Records released with the takedown indicate the government seized more than $182 million in cash, luxury vehicles, jewelry, and other assets, while the Centers for Medicare and Medicaid Services moved to suspend 1,079 providers and revoke billing privileges for 1,403 others. Prosecutors highlighted a $906 million wound-graft (amniotic allograft) scheme charged in the Southern District of Texas, in which a nurse practitioner allegedly billed Medicare more than $1 million per patient on average; the government reports seizing over $30 million in bank accounts, a $594,000 Ferrari, and an $865,000 Bulgari necklace. The Department also alleges a separate $89 million cardiovascular-testing scheme in the Southern District of Florida in which a student athlete with an undiagnosed enlarged heart later died — a reminder that the Department classifies health care fraud as a patient-safety issue, not merely a financial one.
The takedown also reflected international cooperation: court documents state that Ibrahim Hilmi, tied to an additional $3.7 billion in alleged false claims, was apprehended in Kyrenia, and that Herb Kimble, a fugitive in a $1.2 billion telemedicine scheme, was apprehended in the Philippines. Acting Attorney General Todd Blanche framed the action as part of a “whole-of-government” anti-fraud effort run through the newly created National Fraud Enforcement Division. The charges are allegations; the Department notes all defendants are presumed innocent until proven guilty.
2. John Bolton pleads guilty to retaining national defense information
In a case with significant national-security implications, former National Security Advisor John R. Bolton, II, 77, pleaded guilty on June 26 to willfully retaining national defense information, a violation of the Espionage Act. Unlike most items in this digest, this is a resolved matter: Bolton admitted the conduct in federal court in the District of Maryland.
According to court documents, while serving as National Security Advisor between April 2018 and September 2019, Bolton incorporated information classified up to the TOP SECRET level — including Sensitive Compartmented Information — into “diary” entries and transmitted them to two unauthorized family members through personal email and a messaging application not approved for classified material. The filings state that Bolton’s personal email account was later hacked by a cyber actor believed to be associated with the Islamic Republic of Iran, and that he reported the hack without disclosing that the account contained national defense information.
Bolton was indicted in October 2025 on 18 counts; the plea agreement resolves all of them. Under its terms, he faces a maximum penalty of 60 months in prison and agreed to a $2.25 million fine, and the conviction bars him from collecting a federal annuity. Sentencing is set for October 28 before U.S. District Judge Theodore D. Chuang.
3. Eighth defendant charged in White House UFC attack plot
The Department announced on June 26 that Alexander Iniguez Mercado, 20, of Chicago, was arrested and charged with obstruction of justice in connection with a foiled plot to attack the June 14 Ultimate Fighting Championship event held at the White House. According to the indictment returned in the Northern District of Illinois, Mercado was an administrator of Signal messaging groups whose members discussed the planned attack, and he allegedly uninstalled the application after an FBI agent contacted him, rendering related data unavailable.
Mercado is the eighth person charged in the investigation, which prosecutors say involved threats to public safety including the safety of attendees and government officials. If convicted, he faces up to 20 years in prison. The charge is an allegation, and Mercado is presumed innocent. The case is being prosecuted by the U.S. Attorney’s Office for the Northern District of Illinois with assistance from the National Security Division — a configuration worth watching as the remaining defendants move toward trial.
4. Tren de Aragua-linked ATM “jackpotting” defendants sentenced
Two Venezuelan nationals were sentenced to 78 months each for their roles in an ATM “jackpotting” conspiracy that DOJ links to the designated transnational criminal organization Tren de Aragua. According to court documents, Carlos Javier Padron, 36, and his co-defendant deployed a variant of malware known as Ploutus to force ATMs to dispense cash, and were ordered to jointly pay $1,537,696 in restitution to victim banks.
The Department says the broader investigation, run out of the District of Nebraska, has produced indictments against 96 additional defendants on charges including material support to a designated foreign terrorist organization, bank burglary, and money laundering. Prosecutors characterize ATM jackpotting as a significant revenue source for Tren de Aragua. These are findings rather than allegations as to Padron, who has been sentenced; the 96 additional defendants are charged and presumed innocent.
5. U.S. seizes nearly 400 domains streaming World Cup matches
As the United States co-hosts the 2026 FIFA World Cup, the Department announced on June 26 the seizure of nearly 400 internet domains used to illegally stream matches in violation of U.S. copyright law. According to an affidavit filed in the Eastern District of Virginia, the seized domains broadcast real-time streams of World Cup matches without authorization; they were identified with assistance from FIFA and several rights holders.
The action, dubbed Operation Offsides and led by the National Intellectual Property Rights Coordination Center, was coordinated with international partners, with related disruptions reported in Peru, Bulgaria, Croatia, Romania, Poland, and Colombia. The Department framed the seizures both as intellectual-property enforcement and as a consumer-protection measure, noting that piracy sites can expose viewers to malware. This is a civil seizure action; no defendants were named in the announcement.
6. Honduran national sentenced in $89 million payroll-tax scheme
On June 25, the Department announced that Mario Flores, of Honduras, was sentenced to 96 months in prison for operating an off-the-books cash payroll scheme that prosecutors say caused a tax loss of more than $38 million. According to court documents, from 2015 to 2022 Flores and others created shell companies that cashed roughly $89 million in checks for construction subcontractors, enabling employers to pay workers in cash without withholding payroll taxes.
The Department reports that a co-conspirator, Iris Villafranca, was previously sentenced to 17 years in prison and ordered to pay more than $38 million in restitution and forfeit $89 million in proceeds. The case, prosecuted by the Criminal Division’s Tax Section and the Middle District of Florida, reflects a stated enforcement priority connecting tax fraud to unauthorized employment. Flores has been sentenced, making this a resolved matter.
7. Arizona woman pleads guilty to $7.7 million pandemic-credit fraud
Rounding out the week, Regina Durkin, of New River, Arizona, pleaded guilty to conspiracy to file false claims after, according to court documents, submitting 14 fraudulent claims to the IRS seeking more than $7.7 million in refunds. Prosecutors say the claims were based on the employee retention credit and paid sick and family leave credit — pandemic-era programs — for companies that were not operating, had no employees, and paid no wages.
Durkin is scheduled to be sentenced on September 11 and faces a maximum of 10 years in prison. The matter was investigated by IRS Criminal Investigation and prosecuted by the Criminal Division and the District of Arizona. The guilty plea makes the underlying conduct a finding rather than an allegation, though the sentence remains to be determined.
Cases that warrant a deeper TIJ look
Three threads from this week merit follow-up reporting. First, the health care takedown’s data-analytics component — including a new Data Fusion Center and an agreement giving fraud prosecutors access to CMS claims data — represents a structural shift in how the government detects fraud and deserves scrutiny on both effectiveness and civil-liberties grounds. Second, the FBI’s Most Wanted Fraudsters List now includes Khalid Satary, sought in a $547 million genetic-testing scheme and believed to be in the United Arab Emirates, and Emylee Thai, who DOJ says fled to Vietnam; their cases raise questions about extradition and bond practices in large fraud matters. Third, the June 23 seizure of backend infrastructure tied to the Cambodia-based Huione Group points to the growing intersection of Southeast Asian money-laundering networks and U.S. financial crime — a beat TIJ will continue to track.
Reporting by Eduardo Bacci for The Investigative Journal. Sources: U.S. Department of Justice Office of Public Affairs press releases, June 23–26, 2026. Featured image: Robert F. Kennedy Department of Justice Building, photo by APK via Wikimedia Commons, licensed CC BY 4.0.