German and Brazilian authorities have arrested four suspected cybercriminals and identified three others in Europe over the theft of more than €30 million from German bank customers.
The theft took place over four days in November 2023. Authorities say the group exploited a vulnerability at a financial service provider, which was caused by a flawed software update. The attackers then made numerous unauthorized withdrawals from German online banking accounts. Most of the stolen money was transferred to Brazil, while smaller amounts were withdrawn in several European countries.
Police say the group used bank accounts, companies, payment services, virtual-asset platforms and payment cards to hide the source of the money.
Brazilian authorities launched “Operation Klonen” on August 16, carrying out 21 search warrants across seven cities. Four suspects were arrested in Rio de Janeiro, Guarulhos, Goiânia and Carapicuíba. Three other suspects were identified in Europe and are expected to face prosecution in Spain and Bulgaria.
Brazilian authorities also ordered the seizure of assets, vehicles and property worth up to 106 million Brazilian reais, or about €22 million. One of the suspects allegedly used some of the stolen money to support a political campaign in 2024.
The suspects face charges including aggravated electronic fraud, participation in a criminal organization and money laundering.