Brazilian and German federal police have arrested four suspects and identified three more facing charges in Spain and Bulgaria over a scheme that exploited a vulnerability at a payment service provider to steal roughly €30 million ($34.6 million) from bank customer accounts.
The theft took place over four days in November 2023, though the arrests and coordinated raids only happened this week under an operation Brazilian police dubbed “Operation Klonen.” German authorities say the attackers took advantage of a software vulnerability introduced by a faulty update to a financial institution’s payment and transaction-processing system, using it to trigger numerous unauthorized withdrawals from German online banking accounts.
Neither Germany’s BKA nor Brazilian Federal Police officially named the affected bank, but Brazilian media identified it as Commerzbank. In a statement to BleepingComputer, a Commerzbank spokesperson confirmed customers were affected by “unauthorized direct debits” stemming from “technical issues at a service provider,” but said no customers suffered financial losses and that the bank cooperated closely with investigators throughout.
Investigators found that most of the stolen funds were cashed out in Brazil, with a smaller share withdrawn across four other European countries. To launder and conceal the proceeds, the network reportedly relied on pass-through accounts, shell companies, payment institutions, virtual-asset platforms, and payment cards issued without the account holders’ knowledge or consent.
Raids and asset seizures
Brazil’s Federal Police, supported by Germany’s BKA, executed 21 search-and-seizure warrants across seven cities on August 13. Four suspects were taken into preventive detention in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba. A Brazilian federal court separately ordered the seizure of financial assets, vehicles, and real estate valued at up to R$106 million (about $22.4 million).
Notably, investigators determined that one of the arrested suspects ran for elected office in Brazil in 2024 and used part of the stolen funds to finance the campaign.
The suspects face charges including aggravated theft through electronic fraud, participation in a criminal organization, and money laundering. Prosecution of the three additional suspects identified in Europe will proceed separately in Spain and Bulgaria.
The case underscores how vulnerabilities introduced through third-party service providers, rather than the bank’s own systems, can still expose customer accounts to large-scale fraud, and highlights the increasingly international and multi-layered laundering infrastructure used to move stolen funds across borders.