Four cybercriminals were arrested in Brazil and three others were indicted in Europe on charges of exploiting a vulnerability in a service provider that allowed them to withdraw funds from the bank accounts of Commerzbank customers.
The theft, investigated by Brazilian and German federal police agencies, took place over four days in November 2023 and caused losses of around 30 million euros ($34.6 million).
Although neither Brazil’s federal police nor Germany’s BKA named the German financial institution affected, Brazilian media identified it as Commerzbank, a major European financial institution that generates more than 11.1 billion euros ($12.8 billion) in annual revenue.
In a statement to BleepingComputer, the bank confirmed that its customers were affected by the fraudulent activity, but that customers did not suffer any financial loss.
“The fraud case is known and dates back to 2023. Due to technical problems at a service provider, unauthorized direct debits were made from customer accounts. There was no financial loss to customers. We cooperated closely and extensively with the authorities,” a Commerzbank spokesperson told Bleeping Computer.
German authorities say that hackers exploited a software vulnerability introduced by a faulty software update to a financial institution’s payment and transaction processing system.
In November 2023, the attackers initiated multiple unauthorized withdrawals from various German online banking accounts and routed the stolen funds to Brazil through a larger network designed to disguise their origin.
According to the authorities, most of the funds were withdrawn in Brazil, while a smaller share was cashed in four European countries.
Police have identified three more suspects in Europe who will be pursued in Spain and Bulgaria by law enforcement agencies in both countries.
Investigators found that the attackers moved and concealed the proceeds through transfer accounts, companies, payment institutions, virtual asset platforms and payment cards issued without the consent of the beneficiaries.
Yesterday, Brazil’s federal police launched “Operation Klonen” with the support of Germany’s BKA and executed 21 search and seizure warrants in seven cities in Brazil.
The operation led to the arrest of four suspects with preventive detention orders in Rio de Janeiro, Guarulhos, Goiânia and Carapiquiba.
Brazilian authorities discovered that one of the suspects ran for elected office in 2024 and used some of the illegal funds to support his political campaign.
A Brazilian federal court also ordered the confiscation of financial assets, vehicles and real estate worth up to 106 million real dollars ($22.4 million).
Those arrested face various charges, including theft by wire fraud, participation in a criminal organization and money laundering.
Generic prevention scores can hide what happens after initial access. Once attackers use valid credentials, prevention plummets.
The 2026 Blue Report measures security techniques by techniques in 338 million simulations run in customer production environments.
