The news first circulated last March. The United States Department of Justice announced that a Lithuanian named Evaldas Rimasauskas was accused of stealing $100 million from "two multinational companies" through a phishing campaign. At that time, the companies' names were not revealed, but Fortune revealed after a long investigation that the victims were Facebook and Google. Most of the funds have already been recovered, but there is a small detail: Neither of the two companies informed its shareholders about the scam.
The Phishing Campaign
The story begins with Evaldas Rimasauskas, a 48-year-old Lithuanian, who in 2013 started a complex phishing campaign via email. Rimasauskas posed as none other than Quanta Computer, a Taiwanese hardware giant with a notable list of clients, including Apple, Amazon, Hewlett-Packard, Cisco and Sony. Rimasauskas took the trouble to fake email addresses, receipts, and corporate seals to such a level that he managed to deceive his victims for two years. The sum extracted by Rimasauskas amounted to $100 million, distributed across multiple accounts throughout Eastern Europe.
The Investigation and the Silence
The formal accusation by the Department of Justice was filed in December 2016, but the process became public last March. With the scammer in custody in Lithuania awaiting extradition and the final sum calculated, the only thing left to establish was the identity of the victims. The folks at Fortune conducted their own internal investigation, and after several interviews they were able to confirm that the affected companies are Facebook and Google. Both titans of the Web indicated that they managed to recover the money, and from their point of view they consider the incident closed (or at least, until Rimasauskas goes to trial). However...
… what draws attention is the previous silence. According to current securities laws, public companies must provide their shareholders with all available information on "significant events", and the theft of $100 million falls into that category, but when examining the public records of Google and Facebook, nothing related to the scam appears. In theory, this omission does not violate the Securities and Exchange Commission guidelines, and people close to both companies said that Rimasauskas's case was not big enough to report. Even so, that decision sows a seed of doubt. How good is internal security? How are assets controlled? Even though the funds have been recovered, it does not convey a great sense of responsibility to silence the theft of millions of dollars.
Fortune
