Police bust cybercrime ring accused of stealing €30 million in four-day spree
German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria.
Brazilian police named the operation “Klonen.” On August 13, agents executed 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and Guarulhos.
The case traces back to late 2023, when attackers exploited a flaw in the booking process of a German payment service provider.
“The extensive, multi-year investigation initially focused on the technical processes behind the booking procedures and financial transactions. According to current findings, the internationally organized perpetrators directly exploited a vulnerability in the booking process caused by a faulty software update. This vulnerability enabled numerous unauthorized withdrawals within a timeframe of just four days,” German authorities said.
“The extent of the damage is in the millions,” they added.
Investigators say the group ran the stolen funds through a criminal fraud network, sending most of the money to Brazil, where it was cashed out after several attempts to hide its trail. A smaller share moved through similar schemes in four other European countries.
According to the Polícia Federal, the group moved and concealed the funds using payment cards issued without the beneficiaries’ consent, pass-through accounts, companies, payment institutions, and virtual asset platforms.
Investigators also found that one of the suspects ran for elected office in 2024, financing part of the campaign with stolen money.
A Brazilian federal court ordered the seizure of financial assets, vehicles, and real estate worth up to approximately R$106 million (about $20.7 million).
“Those under investigation may be held accountable, to the extent of their responsibilities, for the crimes of aggravated theft through electronic fraud, criminal organization, and money laundering, without prejudice to other criminal offenses identified during the investigation,” Brazilian police noted.
The operation was carried out by Brazil’s Polícia Federal with support from Germany’s Bundeskriminalamt (BKA) and the Frankfurt Public Prosecutor’s Office’s cybercrime unit, ZIT.