The $122 Million Email That Fooled Tech Titans
In the corporate world, Google and Facebook represent the pinnacle of technical sophistication. They hire thousands of world-class security engineers and operate sophisticated data infrastructure. Yet between 2013 and 2015, both tech behemoths fell victim to a deceptively simple Business Email Compromise (BEC) attack that siphoned off $122 million USD ($99 million from Google, $23 million from Facebook).
The attacker, a Lithuanian national named Evaldas Rimasauskas, did not write a single line of zero-day exploit code or deploy complex ransomware. Instead, he exploited human trust and vendor payment workflows.
Key Incident Metric: $122,000,000 stolen across 24 months. Industry threat reports show corporate accounts payable departments are prime targets for lookalike vendor identity attacks.
Anatomy of the Attack: Spoofing Quanta Computer
Google and Facebook regularly bought hundreds of millions of dollars in computer servers, storage racks, and data center hardware from Quanta Computer, an established Taiwanese manufacturing giant.
Rimasauskas capitalized on this routine commercial relationship by executing a multi-year social engineering campaign:
- Incorporating a Mirror Entity: In 2013, the attacker registered a shell company in Latvia with the exact same corporate name — Quanta Computer Inc. — and opened corporate bank accounts across Latvia, Cyprus, Lithuania, Hungary, and Hong Kong.
- Forging Authentic Documentation: Using forged corporate letterheads, fabricated contracts, counterfeit commercial invoices, and replicated corporate seals, the attacker emailed accounting personnel at both companies.
- Posing as Accounts Receivable: The attacker requested that regular multi-million dollar equipment payments be redirected to "new international routing accounts" for tax optimization.
- Dispersing the Funds: Once funds cleared into Eastern European and Asian accounts, they were laundered through dozens of secondary shell bank accounts worldwide.
Why Did Internal Controls Fail?
This attack succeeded because it targeted the intersection of human assumptions and organizational bureaucracy:
- Vendor Routine: Accounting personnel processed hundreds of millions in legitimate hardware invoices monthly; the fraudulent transactions looked indistinguishable from legitimate business dealings.
- Absence of Out-of-Band Verification: No finance officer picked up a physical phone to call the pre-established Taiwanese vendor contact to verbally verify the bank account change.
- Email Domain Spoofing: Attackers utilized spoofed sender headers and lookalike domains that evaded standard visual checks.
The Aftermath and Legal Resolution
Rimasauskas was arrested in Lithuania in 2017, extradited to the United States, and in December 2019 was sentenced to 60 months in federal prison along with $49.7 million in forfeiture.
Remarkably, through immediate emergency legal injunctions and international coordination, Google managed to recover the vast majority of its $99 million, and Facebook recovered its $23 million. Most small-to-medium businesses never recover stolen BEC wire transfers.
Key Prevention Takeaways for Organizations
- Strict Dual-Signoff Protocol: Mandate that any change to supplier banking details requires two independent approvals.
- Mandatory Out-of-Band Callback: Never verify new payment routing details via email or numbers listed on incoming invoices. Always dial the verified supplier phone number on file.
- Regular Phishing Simulations: Train finance, accounts payable, and procurement teams against targeted vendor-impersonation scenarios using CyberAuditX Phishing Simulations.