Brazilian police arrest four in €30 million Commerzbank cyber heist
This digest was compiled by AI from multiple sources — links to the originals are below.
Brazilian police arrested four suspects on August 13 in connection with a €30 million cyber heist that targeted Commerzbank customers in 2023. German and Brazilian authorities executed 21 search warrants across seven cities and identified three more suspects in Europe who face prosecution in Spain and Bulgaria.
Key Facts
- The operation, named Klonen, included 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and Guarulhos.
- Prosecutors say the attackers exploited a faulty software update in the processing system of a German payment service provider in 2023, allowing unauthorized withdrawals over four days.
- The fraud moved roughly €30 million ($34.7 million), with most of the funds sent to Brazil and cashed out through a criminal network.
- A Brazilian court ordered the seizure of around R$106 million ($20 million) in financial assets, vehicles, and real estate.
- Commerzbank confirmed the fraud dates to 2023 and said customers had no financial loss.
The Arrests
Brazilian police arrested four suspects on August 13 during Operation Klonen, supported by Germany’s Federal Criminal Police Office (BKA). Officers executed 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and Guarulhos. The Frankfurt Public Prosecutor’s Office said the operation followed a multi-year investigation into international computer fraud involving online banking. Authorities identified three additional suspects in Europe, with prosecutions expected in Spain and Bulgaria.
The Fraud Mechanism
Prosecutors said the attackers exploited a vulnerability in the processing system of a German payment service provider caused by a faulty software update in 2023. The flaw enabled numerous unauthorized debits from customer accounts within a timeframe of four days. German authorities said the damage is in the millions of euros. Commerzbank, identified by Brazilian media as the affected bank, said the case dates to 2023 and resulted from technical issues at a service provider.
Money Trail and Seizures
Investigators said most of the roughly €30 million was moved through a criminal fraud network to Brazil, where it was cashed out. A smaller portion was cashed out in four European countries. A Brazilian court ordered the seizure of around R$106 million ($20 million) in financial assets, vehicles, and real estate. One identified suspect ran for office in 2024 and used some of the stolen funds to finance his campaign.
2 sources
Brazilian police arrest four in €30 million Commerzbank cyber heist
