Seven individuals have been charged in connection with a sophisticated cyber fraud operation that exploited a vulnerability at a service provider, leading to the unauthorized withdrawal of approximately €30 million ($34.6 million) from customer accounts at a major German financial institution. Four arrests were made in Brazil, while three other suspects face prosecution in Europe.
The fraudulent activity occurred over a four-day period in November 2023. While German and Brazilian federal police agencies did not initially name the affected institution, Brazilian media identified it as Commerzbank. Commerzbank subsequently confirmed that its clients were impacted by the incident, which stemmed from "technical issues at a service provider" that enabled unauthorized direct debits. The bank emphasized that customers suffered no financial losses as a result of the fraud.
German authorities indicated that the attackers exploited a software vulnerability introduced by a faulty update within the payment and transaction-processing system of a financial institution. This allowed the initiation of numerous unauthorized withdrawals from various German online banking accounts. The stolen funds were then routed to Brazil through an extensive network designed to obscure their origin.
Investigators determined that the largest portion of the funds was withdrawn in Brazil, with a smaller amount cashed out across four European countries. The proceeds were allegedly moved and concealed through a complex web of pass-through accounts, shell companies, payment institutions, virtual-asset platforms, and payment cards issued without the beneficiaries' consent.
On August 13, Brazil's Federal Police, with support from Germany's BKA, launched "Operation Klonen." This operation involved executing 21 search-and-seizure warrants across seven Brazilian cities, leading to the preventive detention of four suspects in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba.
Brazilian authorities discovered that one of the arrested suspects had run for elected office in 2024 and allegedly used some of the illicit funds to finance their political campaign. A Brazilian federal court also ordered the seizure of financial assets, vehicles, and real estate valued at up to R$106 million ($22.4 million).
The arrested suspects in Brazil face charges including aggravated theft through electronic fraud, participation in a criminal organization, and money laundering. The three additional suspects identified in Europe will be prosecuted by law enforcement authorities in Spain and Bulgaria.
