STEALING $120M: This man stole $120 million
from Google and Facebook and nearly got away with it. Hearing this, you’re probably thinking that
this guy, Evaldas Rimasauskas, was some sort of insane hacker or insider. He must’ve breached
through Google’s security systems or used insider knowledge to siphon money from Facebook. But,
in reality, he was just an ordinary man from Lithuania, and the scheme he used wasn’t
especially notable either. He used a classic email phishing scheme, yet somehow, he was able to trick
some of the smartest people and companies in the world. The craziest part was that these companies
didn’t even know they were being scammed, and he could’ve easily gotten away with it if didn’t try
to push his luck. You see, Evaldas didn’t just set out to hit a jackpot and retire. He was looking to
defraud as many companies for as much money as possible. So, everytime he hoodwinked a company,
he would just do it again to the same company or next company. Originally, he stole $23 million
from Google throughout 2013. At that point, that’s literally generational wealth, but our
man Evaldas wasn’t happy. Just 2 years later, he would target Facebook and bag another $98 million.
This greed would eventually get him noticed though and these companies would notify the FBI who would
track him down to Lithuania. They would of course arrest him and he would be sentenced to 5 years
of jail. But, the same could not be said about his associates who were never found. Apparently,
Evaldas would wire money the stole funds all around the world as soon as he received them.
So, who knows how many people were involved and how much they were each able to get away
with. But, all of this begs the question. How did he do it? How was he able to outsmart the
smartest companies in the world and get away with it for years? And what does that mean regarding
the security of the data that all of us have stored on these platforms? Well, here’s the story
of Evaldas Rimasauskas, the guy who stole $120 million from tech companies and nearly got away.
FINDING THE WEAK SPOT: Taking a look back, the story
of Evaldas Rimasauskas traces back to the early 2010s to Lithuania. Like any country, Lithuania
is mostly filled with awesome law-abiding people and great culture, but unfortunately,
they are notorious for one crime: car theft. If you’ve ever heard of someone’s car being stolen,
it was probably dismantled within no time and shipped off to Lithuania. From there,
the car parts are listed on sites like eBay like nothing happened. Their listings are usually way
cheaper than everything else on the market for well obvious reasons. But, by the early 2010s,
authorities were starting to catch on and they were busting these car rings left and right. So
our man, Evaldas, needed a new strategy, something that wasn’t so hot and risky, something that no
one was even paying attention to. One of the main problems with carjacking for criminals is that it
basically always gets notified to the police. I mean, who wouldn’t report to the police that
they had their car stolen. Not to mention, car jacking wasn’t even all that lucrative given how
much risk was involved. If you wanted to make a million dollars for example and you sold each
car part for $500 on average, you would need 2000 car parts. This means that you would have
to steal dozens resulting dozens police reports. Obviously, not a very good risk to reward ratio,
so Evaldas decided to hatch up his own plan. He first asked himself where can I get a lot
of money without the victim even noticing and the answer became clear pretty quickly: filthy rich
tech companies. There was only one problem, he was by no means the first or last person to think
of this idea. Tech companies know all about how they’re vulnerable to cyber attacks not just to
steal money but to steal personal data, top secret technology, and confidential information. Yes,
even the CIA stores their information on Amazon servers. So, maintaining a secure public image
is no doubt a top priority for these companies, and I don’t you’d be surprised to hear that these
tech companies invest tens of billions into cybersecurity. But, this really only protects
these companies against cyber threats. People who are trying to directly hack into their systems to
wreak havoc. Evaldas wasn’t even considering this option because well he didn’t even stand a chance
against the IT departments of these companies. So, Evaldas looked to identify a weaker entry point,
somewhere money was already exiting the company. This left Evaldas with really only one options:
the payroll department. For most companies, paying employees and other businesses is by far their
biggest expense and Google and Facebook were no exception. Google, for example, spent $56 billion
on payroll last year. But, paying employees is pretty a streamlined and high scrutinized process,
so this wasn’t exactly a great entry point. Paying businesses, however, was highly custom
and usually handled on a case by case basis. So, if you posed as a business, you would only have to
trick the handful of people who are approving a given invoice not the company’s entire IT
department or security infrastructure. And with that, Evaldas had his entry point.
HITTING THE JACKPOT:
Companies like Google and Facebook payout money to thousands if not tens of thousands
of different companies for all sorts of reasons from manufacturing and logistics to research
and legal services. While newer partners may get more scrutiny when it comes to billing,
most established partners just send over invoices and these companies approve
them without a second thought. So, Evaldas decided to pose as one of these partners,
a company called Quanta Computer. Like me, most of ya’ll have probably never heard of this company so
here’s what they do. Quanta is a Taiwanese manufacturer that specializes in producing
enterprise hardware like servers. They’re actually super reputable in the industry as they work with
basically every tech company you can think of. This includes Apple Dell, HP, Amazon, Cisco, LG,
Sony, Microsoft, Facebook, and so much more. So, I don’t think you’d be surprised to hear that they
pull in over $40 billion worth of revenue and $1.5 billion worth of profit every year. Similarly,
Google and Facebook weren’t surprised when they received tabs worth a couple million dollars
from Quanta. Evaldas went ahead and created fake invoices and contracts and signed them with the
name of various leaders at Quanta. He would then send over these documents to Google and Facebook
from a Quanta domain email address. You know those random emails that you get from Apple and Amazon
stating that you’ve been charged X amount. Well, this is exaclty what Evaldas was doing,
but instead of targeting elderly folks who don’t know better for a few hundred bucks, Evaldas was
targeting tech giants for millions. Same tactic, completely different scale. With all the articles
that these companies put out about identifying and stopping phishing, you would think that the staff
at these companies would know better, but it turns out they didn’t. They would fall for this scam not
once or twice or three times. They would fall for it over and over and over and over again. You see,
it’s not like Evaldas charged Google $23 million and Facebook $98 million in one fell swoop.
According to the department of justice, Evaldas would regularly send multi million dollar invoices
to these companies. If we assume that each invoice was worth $4-5 million, Evaldas trolled Google 5
times and Facebook a laughable 20 times. But, it doesn’t even stop right there. So, alright
whatever, people at these companies didn’t put too much scrutiny on these invoices and they approved
them. They must have some sort of established payment system with these companies right? So,
even if they accidently made an unnecessary payment, it would be no problem getting the
money back from the real company. Surely, these companies weren’t sending tens of millions to
some random ass Latvian bank accounts detailed in the invo..they were sending tens of millions
to some random ass Latvian bank accounts detailed in the invoice. To be honest, I’m not gonna defend
Evaldas, but you can’t feel too bad for these companies either. There’s really no one to blame
but themselves and their gross negligence. In this situation, any normal person would have no chance
of any recourse, but given the power and status of these companies, you can bet they got justice.
IT ALL FALLS DOWN: Evaldas
was smart enough to not hold onto the money in the same account that he received it. He
would instantly spread the money across the world into bank accounts in Latvia, Cyprus, Slovakia,
Lithuania, Hungary, and Hong Kong. Considering this, it’s surprising that he didn’t take more
precautions to secure his own freedom. With all this money, he could’ve easily moved
to a non-extraditing country like the United Arab Emirates and lived it up in Dubai. But,
he would stick to Lithuania. I guess, he must’ve felt that he was safe behind his
computer screen and that as long as the money was dispersed and untrackable he was good. This was a
blunder though. As soon as Google and Facebook noticed some discrepancies in their accounting,
they would identify the fraudulent charges and notify the FBI. For the FBI, tracking down someone
like Evaldas was relatively easy and they would have him cornered in no time. With no plausible
deniability, Evaldas would just plead guilty, and eventually, he’d be sentenced to 5 years in
prison. If you’re wondering what happened to the money, well, Evaldas would forfeit $49 million
of it and he was ordered to pay $27 million in restitution. Facebook and Google would claim
this as a victory as they were technically able to recover the majority of the funds,
atleast on paper. It’s not clear if Evaldas has paid the restitution yet or if he ever will,
so that still leaves $44 to $71 million worth of stolen funds unaccounted for. But,
I don’t really think Google or Facebook really cares about recovering these funds. For Google,
the total stolen funds are equivalent to 3.5 hours of profit. For Facebook,
the total stolen funds are equivalent to 37 hours of profit. So, for these companies,
catching Evaldas and putting him behind bars was more about the principle and making a statement
than actually recovering the funds. Spending more effort on recovering the remaining funds is really
just not worth it for these companies. So, Evaldas may very well have a fortune to return to when he
eventually gets released around the end of 2024. But, all of this still leaves the question, how
was he able to pull of something so simple against these companies. Well, the brightside is that
while this incident is truly quite embarassing for these companies, it’s not indicative of their IT
or cybersecurity. As far as we know, their systems are still as strong and secure as ever. And this
incident has little to do with anything other than gross negligence and oversight.
THE GRAND SCHEME: In the end, this story
shows us that no company is truly 100% secure. I mean, a random person in Lithuania was literally
able to pull a quick one on Google and Facebook with very little skills and resources. All he had
to do was attack them where they weren’t looking. He could’ve gotten away with it too if he played
his cards just a little better. But, who’s to say that he didn’t come out on top anyway. I’m
sure there’s a lot of people who’d be happy to do 5 years in jail for $40 to $70 million
and the title of successfully scamming Google and Facebook. And that’s the story of the guy
who stole a $120 million from Google and Facebook and nearly got away with it. Do you feel bad for
Google or Facebook? Comment that down below. Also, drop a like if you can’t believe these
companies fell for it. And of course, consider checking out our discord community to suggest
future video ideas and consider subscribing to see more questions logically answered.