German and Brazilian authorities announced coordinated arrests this week connected to a late 2023 hack that siphoned an estimated €30 million ($34.7 million) from German bank accounts. Germany’s federal police agency, the BKA, said three suspects were detained in Europe and charged with fraud, while Brazil’s federal police arrested four more people domestically on related charges as part of an operation dubbed Operação Klonen (Operation Clone).
The Brazilian action included 21 search and seizure warrants carried out nationwide. According to the BKA, the underlying intrusion took place over four days in November 2023, when attackers exploited a vulnerability in a payment provider to make numerous unauthorized withdrawals from German online banking customers’ accounts. Brazilian police described the method as involving cloned payment cards.
Investigators said the stolen funds were laundered through networks spanning Brazil and four European countries. Spanish and Bulgarian authorities assisted in the case alongside the Frankfurt public prosecutor’s office, and the BKA said the three suspects arrested in Europe will face prosecution in Spain and Bulgaria.
Bank Not Officially Named
Neither police agency publicly identified the affected financial institution, but Brazilian media outlets reported it was Commerzbank. German media had previously reported in late 2023 that the Frankfurt-based bank suffered a €30 million breach, at which point Commerzbank said affected customers would not bear any losses. The bank did not immediately respond to a request for comment on this week’s arrests.
Seized Assets and a Political Twist
Brazilian courts ordered the seizure of financial assets, vehicles, and real estate worth more than $20 million tied to the investigation. Police also said they recovered a 3-D printer allegedly used to manufacture weapons during the sweep for suspects.
In an unusual detail, Brazilian police said one person identified during the investigation was a 2024 candidate for elected office who used part of the illicit proceeds to fund his campaign. Police did not release the individual’s name, but local media reported he had run for a city council seat in Rio de Janeiro.
The case underscores how payment provider vulnerabilities can enable large-scale, cross-border fraud schemes that blend technical exploitation with traditional money laundering and card cloning operations, requiring multinational law enforcement cooperation to unravel.