Federal prosecutors allege three foreign nationals combined synthetic voices, impersonations of corporate executives, and cross-border money movement to steal more than $129 million from companies worldwide.
A California Hospital Was One of Thousands of Alleged Targets
A California hospital system lost nearly $3 million in December 2024 after employees were allegedly manipulated into authorizing a wire transfer.
A California hospital system identified in court documents only as “Victim Company-4” allegedly lost $2,968,497 in December 2024. Prosecutors say the conspirators posed as the hospital’s chief executive and an attorney at a large international law firm to make the request appear legitimate.
Three Foreign Nationals Face Seven Federal Charges Each
Federal prosecutors in the Southern District of New York have charged three defendants whose arrests spanned two countries.
Federal prosecutors in the Southern District of New York charged Jacob Soall, 41; Sharon Hazan, 54; and Guy Sheetrit, 42, with running the alleged scheme from July 2024 through February 2026. Soall and Hazan were arrested in Spain in June and August, respectively, while Sheetrit was taken into custody in the United Kingdom in September, with extradition proceedings pending at the time charges were announced. All three defendants are presumed innocent, and the allegations remain unproven in court.
How the Alleged Scheme Worked, Step by Step
Prosecutors allege the operation moved from fraudulent email requests to AI-generated impersonation before routing stolen funds through nine countries.
The operation reportedly began with fraudulent emails or electronic-signature requests sent through platforms such as DocuSign. Those requests asked employees to sign fake nondisclosure agreements connected to purported confidential financial transactions. Once a target was engaged, prosecutors allege the conspirators deployed AI-generated voices and images to impersonate senior executives and outside counsel.
Soall allegedly prepared a script labeled “Lawyer Call” for use while posing as a British attorney. According to the indictment, the script directed victims to keep the transaction secret and not discuss it with colleagues.
After transfers cleared, the money allegedly moved through accounts in nine countries, including China, Spain, and the United Arab Emirates, before being converted to cryptocurrency to obscure its origin and distribute proceeds among the alleged conspirators.
The Alleged Losses Spanned Industries and Continents
Prosecutors allege that thousands of companies across multiple industries were targeted for a combined loss exceeding $129 million.
Prosecutors allege total losses exceeded $129 million across thousands of companies worldwide. Other named victims include a Missouri hospital system that lost $4,829,580, a U.K.-based financial technology company that lost $11,578,474, and a Rhode Island bank that lost $2,684,580, along with a Massachusetts mutual fund company and a Florida pet-food company.
Seven Charges Per Defendant
Each defendant faces the same seven federal counts, according to the Justice Department announcement.
Each defendant faces conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, conspiracy to commit money laundering, and two additional money-laundering counts.
What Finance and Security Teams Need to Understand Now
The alleged scheme combined several layers of deception that organizations should recognize as warning signs.
The alleged scheme combined multiple elements: a plausible business pretext, a confidentiality demand, and AI-generated impersonation of executive voices and images. Voice or video confirmation alone should not be treated as sufficient authentication.
Finance leads, hospital administrators, and cybersecurity teams should treat secrecy demands or pressure to bypass standard review as fraud indicators. That standard applies regardless of how credible the requesting voice sounds. Independent, out-of-band verification using a known phone number rather than contact details supplied in the request itself is an important safeguard, especially as attackers increasingly exploit a 2FA exploit to bypass standard verification controls.
Given that the alleged proceeds moved through nine countries before conversion to cryptocurrency, early detection and immediate notification to the organization’s bank are especially important. Cross-border transfers may complicate recovery efforts, making rapid response a priority.
