Main menu


'Office' inspired engineer robbery scheme, say police

featured image

A software engineer embezzled more than $300,000 from his employer by introducing what prosecutors called a “series of malicious software edits” that transferred money into his personal account. If the scheme sounds like the “Office Space” plot, that’s because officials said it was partially inspired by the movie.

Apparently engineer Ermenildo Valdez Castro, 28, of Tacoma, Washington, didn’t watch the entire movie: All evidence of workplace comedy was destroyed in an office fire. But Castro detailed the scheme in a document found on his company laptop, according to Seattle police.

Castro, a former software engineer for e-commerce site Zulily, edited code to divert shipping fees to a personal account and manipulate product prices, stealing an estimated $260,000 in electronic payments and more than $40,000 worth of merchandise. , said the police. He was charged Dec. 20 with two counts of burglary and one count of identity theft and is scheduled to be arraigned on Jan. 26 in King’s County Superior Court in Seattle, where Zulily is headquartered.

According to a police report, a document found on Castro’s work laptop referred to the scheme as the “OfficeSpace project.” He later told police that he “described his scheme to rob Zulily after the movie”.

In the 1999 film, office workers retaliate against corporate downsizing and their terrible bosses by introducing a computer virus into their company’s banking system to embezzle small amounts of money. The film’s characters also drew their scheme from a film, “Superman III”.

Neither Castro nor Zulily responded to a request for comment. It was unclear whether Castro had a lawyer.

According to court documents, Castro stole $110,240 by diverting shipping fees from some customers to an account he controlled on the payment processing website Stripe. After Zulily launched an investigation, Castro wrote an override code that charged some customers double for shipping and forwarded an additional $151,645 in fees to his Stripe account, the documents say. Investigators found that over 30,000 transactions totaling around $263,300 were paid into Mr. Castro between February and June 2022, linked to nearly 25,000 different customer email addresses.

Castro also manipulated the prices of merchandise sold at Zulily, including a sofa bed, and then purchased those items “for pennies on the dollar,” court records show, paying about $250 for nearly 1,300 items worth a total of more than of $41,000. .

Castro joined Zulily’s shopping experience team in 2018 and “was directly involved in coding the customer checkout process,” the police report said. In the spring of 2022, Mr. Castro began “editing Zulily’s software code in a way that would allow him to steal from the company,” according to the report, inserting three types of “malicious code” into the checkout process.

He admitted to police that he edited the code, but said Zulily knew about it and that “it was part of a testing process”, according to the police report. He also admitted to using the associated Stripe account to embezzle shipping fees, and told police the money “ran out” and was invested in the stock market, primarily GameStop.

In May, Zulily’s fraud team uncovered a pattern of steep price adjustments on several products Castro ordered and shipped to his home in Tacoma, as well as to a friend Castro later identified as someone he met on the dating app Inflammable. . According to the police report, Mr. Castro admitted to placing the orders, but said he “had to test an error sending a large amount in an order and that he forgot to cancel the items.”

Mr. Castro did not return any of the items sent to him, and when police searched his home, officers found “an exorbitant number of these items,” some of which were still in their original packaging with a shipping label attached. He was placed on administrative leave on June 3 and was fired six days later, the police report said.

Castro handed over the company laptop after being fired, when Zulily’s cybersecurity team discovered the document labeled “OfficeSpace project.” In it, according to the police report, Castro wrote that his scheme “would cause production traffic to be directed to Stripe.” The document detailed the coding required to pull off the scheme, including a note that he would need to “fake exposure metrics”.

There were also “several entries” that indicated that Castro was preparing to live “off the grid” should he be discovered, according to court documents.

Castro was arrested on July 21 on $999,999 bail. Prison records show he was released two days later.