As the professor in question is obviously supporting Mr. A, your report to him was void and at worst helped them to cover their tracks. Therefore, I would suggest that you report the incident to some uninvolved authority at the university. Ideally this would be an academic-integrity officer or similar, but it can also be the responsible department or faculty, etc. Importantly, this should be nobody with ties to the professor – when in doubt, go one level higher. Also, unless you are contacting an academic-integrity officer or similar, first make sure that you got the right person before you reveal any details.
When you report something, mind that you are merely presenting evidence or hinting at things to look at and it’s the university’s job to figure out the truth. There is little point in getting overly accusatory, emotional, etc.; focus on the evidence.
I strongly advise against contacting the company. The problem with such a case is that your evidence very likely hinges on data on university servers and similar. Thus only the university has the means to reasonably investigate this. Also, you can contact the university solely to report a strong suspicion (which should be legally safe), whereas a report to the company can be considered libel or similar. Consider the possible cases of the company reacting to your report:
- They do not act on your report because they cannot evaluate the evidence and wait for the university to do so. In that case your report achieved nothing.
- They do act on your report and the university revokes Mr. A’s degree. In that case, your report only made things happen a bit earlier.
- They do act on your report, but the university does not revoke Mr. A’s degree for whatever reason. In that case, you may be in legal trouble.