An international law enforcement operation has dismantled a cybercrime ring accused of stealing €30 million from a German financial institution over a four-day period in late 2023. Authorities in Brazil arrested four individuals and are pursuing three additional suspects in Spain and Bulgaria.
The investigation, dubbed "Operation Klonen" by Brazilian police, culminated on August 13 with the execution of 21 search-and-seizure warrants across seven Brazilian cities, including Rio de Janeiro, Goiânia, and Guarulhos. The case originated from an attack that exploited a vulnerability in the booking process of a German payment service provider.
German authorities confirmed that the perpetrators leveraged a flaw in the booking system, which was introduced by a faulty software update. This vulnerability allowed for numerous unauthorized withdrawals to be executed within a concentrated four-day window. The total damage is estimated to be in the millions of euros.
Investigators traced the stolen funds through an elaborate criminal network. The majority of the money was transferred to Brazil, where it was subsequently cashed out after multiple attempts to obscure its origin. A smaller portion of the funds was routed through similar schemes in four other European countries.
According to Brazil's Polícia Federal, the group employed various methods to move and conceal the illicit gains. These included the use of payment cards issued without the beneficiaries' consent, pass-through accounts, shell companies, payment institutions, and virtual asset platforms.
A notable discovery by investigators was that one of the suspects allegedly financed part of a 2024 political campaign with the stolen money. A Brazilian federal court has ordered the seizure of approximately R$106 million (around $20.7 million) in financial assets, vehicles, and real estate linked to the suspects.
Those under investigation face potential charges for aggravated theft through electronic fraud, criminal organization, and money laundering, among other offenses that may emerge during the ongoing inquiry.
The operation was a collaborative effort between Brazil's Polícia Federal, Germany's Bundeskriminalamt (BKA), and the cybercrime unit of the Frankfurt Public Prosecutor's Office, known as ZIT.
