German-Brazilian Cyber Heist Leads to Multiple Arrests in €30 Million Bank Fraud
German and Brazilian authorities have arrested seven suspects in connection with a late-2023 cyber heist that siphoned an estimated €30 million ($34.7 million) from German bank accounts. The coordinated operation, dubbed Operação Klonen (Operation Clone), involved 21 search and seizure warrants across Brazil and targeted a criminal network exploiting a vulnerability in a payment provider.
Over four days in November 2023, hackers executed unauthorized withdrawals from German online banking users, with Brazilian authorities confirming the use of cloned payment cards. The stolen funds were laundered through networks in Brazil and four European countries.
While neither police agency named the affected bank, reports from Brazilian and German media identified Commerzbank as the likely target. The Frankfurt-based bank previously acknowledged a €30 million breach in late 2023 but assured customers they would not bear financial losses.
Three suspects were detained in Europe with prosecutions expected in Spain and Bulgaria while four others were arrested in Brazil. The investigation involved collaboration between German, Brazilian, Spanish, and Bulgarian authorities, as well as Frankfurt’s public prosecutor’s office.
Brazilian courts ordered the seizure of over $20 million in financial assets, vehicles, and real estate linked to the suspects. Notably, one individual under investigation a 2024 city council candidate in Rio de Janeiro allegedly used illicit funds for campaign purposes. Authorities also confiscated a 3D printer used to manufacture weapons during the raids.
Source: https://therecord.media/investigation-into-banking-hack-leads-to-arrests-germany-brazil
Commerzbank AG cybersecurity rating report: https://www.rankiteo.com/company/commerzbank-ag
"id": "COM1786740728",
"linkid": "commerzbank-ag",
"type": "Cyber Attack",
"date": "11/2023",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'customers_affected': 'Online banking users',
'industry': 'Financial Services',
'location': 'Germany',
'name': 'Commerzbank',
'type': 'Bank'}],
'attack_vector': 'Vulnerability in a payment provider',
'customer_advisories': 'Commerzbank assured customers they would not bear '
'financial losses',
'data_breach': {'personally_identifiable_information': 'Payment card details',
'sensitivity_of_data': 'High (payment information)',
'type_of_data_compromised': 'Payment card information'},
'date_detected': '2023-11',
'description': 'German and Brazilian authorities have arrested seven suspects '
'in connection with a late-2023 cyber heist that siphoned an '
'estimated €30 million ($34.7 million) from German bank '
'accounts. The coordinated operation, dubbed *Operação Klonen* '
'(Operation Clone), involved 21 search and seizure warrants '
'across Brazil and targeted a criminal network exploiting a '
'vulnerability in a payment provider. Over four days in '
'November 2023, hackers executed unauthorized withdrawals from '
'German online banking users, with Brazilian authorities '
'confirming the use of cloned payment cards. The stolen funds '
'were laundered through networks in Brazil and four European '
'countries.',
'impact': {'brand_reputation_impact': 'Likely impacted (Commerzbank '
'acknowledged breach)',
'financial_loss': '€30 million ($34.7 million)',
'identity_theft_risk': 'Cloned payment cards used',
'operational_impact': 'Unauthorized withdrawals from bank accounts',
'payment_information_risk': 'High (payment card cloning)',
'systems_affected': 'Online banking systems'},
'initial_access_broker': {'entry_point': 'Payment provider vulnerability'},
'investigation_status': 'Ongoing (arrests made, prosecutions expected)',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Exploitation of payment provider '
'vulnerability'},
'references': [{'source': 'Brazilian and German media'}],
'regulatory_compliance': {'legal_actions': 'Prosecutions expected in Spain '
'and Bulgaria'},
'response': {'communication_strategy': 'Bank assured customers they would not '
'bear financial losses',
'law_enforcement_notified': 'Yes (German, Brazilian, Spanish, '
'Bulgarian authorities)'},
'threat_actor': 'Criminal network (7 suspects)',
'title': 'German-Brazilian Cyber Heist Leads to Multiple Arrests in €30 '
'Million Bank Fraud',
'type': 'Bank Fraud',
'vulnerability_exploited': 'Payment provider vulnerability'}