Unidentified hackers have stolen EUR 40 million from German group Leoni’s Romanian subsidiary using only some cloned email accounts. Leoni's financial director in Romania apparently wired the money into a bank account provided by the hackers via email as she thought the emails came from her bosses in Germany.

German auto parts producer Leoni announced, on August 16, the loss of EUR 40 million following fraudulent activities, which may have involved hackers. The news, which made the headlines around the world, caused a 5.6% drop in the company’s share price in Frankfurt, wiping close to EUR 70 million from the company’s market value.

The stolen sum represents about half of the German group’s net profit and almost 1% of its turnover in 2015. However, nobody knew at that time that the fraud occurred at the group’s subsidiary in Romania.

“Leoni AG realized on Friday, August 12, 2016, that it had become the victim of fraudulent activity with the help of falsified documents and identities and the use of electronic communication channels. As a result, company funds were transferred to accounts abroad,” the company said in a press release.

The company didn’t go into details about this massive fraud and said only that its board had launched an investigation into the events and had also reported the matter to the police criminal investigators.

On the same day that Leoni made this announcement, the prosecutor’s office within the Bistrita Court in Romania received a complaint about a EUR 37 million fraud from Leoni’s subsidiary in Bistrita, in central Romania. As the damage was very big, the prosecutors passed the case to the Directorate for Investigating Organized Crime and Terrorism (DIICOT).

According to preliminary information, the fraud may have been coordinated by a group of hackers who cloned the email accounts of Leoni directors from Germany. They used those false email accounts and asked the financial director of the group’s Romanian subsidiary to wire almost EUR 40 million into a bank account.

The Leoni financial director in Romania apparently followed the company’s internal protocol and wired the money. The money went to a bank account in Czech Republic, according to unofficial sources quoted by Adevarul.ro.

The hackers apparently knew the company’s protocols, including the fact that directors in Germany had asked for money transfers via email before. However, the investigators haven’t yet determined if the Leoni financial director in Romania worked with the hackers or simply followed what she thought were orders from the management in Germany.

Bistrita-based Leoni Wiring Systems Ro manages Leoni’s whole operations in Romania. The German group opened its first factory here in 2003, producing cables for car makers such as Mercedes and BMW. The group opened another factory in Bistrita last year. Leoni has two other cable factories in Romania, one in Arad and the other one in Pitesti.

Its local factories have over 12,700 employees and over EUR 530 million yearly revenues, according to official data from the Finance Ministry.

German group Leoni has over 74,000 employees in 32 countries and total sales of EUR 4.5 billion (in 2015).

German firm could move production from Romania to Moldova, Ukraine

editor@romania-insider.com