Police bust cybercrime ring accused of stealing €30 million in four-day spree
German and Brazilian police arrested four over a €30 million bank fraud exploiting a payment provider's faulty software update, seeking three more in Europe.
Operation Klonen executed 21 search-and-seizure warrants across seven Brazilian cities on August 13, arresting four people while three more suspects are pursued in Spain and Bulgaria. The ring exploited a vulnerability in a German payment service provider's booking process, caused by a faulty software update, to carry out unauthorized withdrawals totaling around €30 million within four days starting in late 2023. Funds were moved to Brazil through payment cards issued without consent, pass-through accounts, companies and virtual asset platforms, and courts ordered seizure of assets worth about R$106 million (~$20.7 million). The operation involved Brazil's Polícia Federal, Germany's BKA and the Frankfurt prosecutor's ZIT cybercrime unit.
- Attackers exploited a booking-process flaw introduced by a faulty software update
- Most stolen funds flowed to Brazil via payment cards, pass-through accounts and virtual asset platforms
- One suspect allegedly financed a 2024 election campaign with stolen money
- Charges include aggravated electronic fraud theft, criminal organization and money laundering
Full article331 words · extracted from helpnetsecurity.com · click to collapse
German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria.
Brazilian police named the operation “Klonen.” On August 13, agents executed 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and Guarulhos.
The case traces back to late 2023, when attackers exploited a flaw in the booking process of a German payment service provider.
“The extensive, multi-year investigation initially focused on the technical processes behind the booking procedures and financial transactions. According to current findings, the internationally organized perpetrators directly exploited a vulnerability in the booking process caused by a faulty software update. This vulnerability enabled numerous unauthorized withdrawals within a timeframe of just four days,” German authorities said.
“The extent of the damage is in the millions,” they added.
Investigators say the group ran the stolen funds through a criminal fraud network, sending most of the money to Brazil, where it was cashed out after several attempts to hide its trail. A smaller share moved through similar schemes in four other European countries.
According to the Polícia Federal, the group moved and concealed the funds using payment cards issued without the beneficiaries’ consent, pass-through accounts, companies, payment institutions, and virtual asset platforms.
Investigators also found that one of the suspects ran for elected office in 2024, financing part of the campaign with stolen money.
A Brazilian federal court ordered the seizure of financial assets, vehicles, and real estate worth up to approximately R$106 million (about $20.7 million).
“Those under investigation may be held accountable, to the extent of their responsibilities, for the crimes of aggravated theft through electronic fraud, criminal organization, and money laundering, without prejudice to other criminal offenses identified during the investigation,” Brazilian police noted.
The operation was carried out by Brazil’s Polícia Federal with support from Germany’s Bundeskriminalamt (BKA) and the Frankfurt Public Prosecutor’s Office’s cybercrime unit, ZIT.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/17/germany-brazil-bank-fraud-ring-dismantled/