Four arrested after hackers siphoned €30M from Commerzbank accounts
Nearly three years after the heist, police have caught up with the alleged cybercriminals.
Image by Cybernews.
Follow us
- Brazilian police arrested four suspects over a €30 million cyber heist targeting Commerzbank customers in 2023.
- Authorities say attackers exploited a faulty software update in a transaction system to make unauthorized debits over four days.
- German and Brazilian police identified three more suspects in Europe, with prosecutions expected in Spain and Bulgaria.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Brazilian police have arrested four suspects in connection with a €30 million cyber heist targeting customers of German banking giant Commerzbank in 2023.
On August 13th, Brazilian authorities, supported by the German Federal Criminal Police Office (BKA), launched a large-scale operation, executing 21 search warrants across seven cities and arresting four people.
The Brazilian and German federal police agencies also identified three suspects in Europe on suspicion of computer fraud involving online banking, who will be prosecuted in Spain and Bulgaria.
According to the official report by the Frankfurt Public Prosecutor's Office, attackers exploited a software vulnerability in the transaction-processing system caused by a faulty software update in 2023.
The vulnerability enabled numerous unauthorized debits within just four days, amounting to losses of around €30 million ($34.7 million).
Prosecutors say that the funds were moved through a criminal fraud network, primarily to Brazil, where a large portion was cashed out. A smaller portion was moved and cashed out in four European countries.
Although authorities did not name the affected bank, Brazilian media identified it as Commerzbank, a major German commercial bank in Frankfurt that operates in more than 40 countries worldwide.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The bank confirmed that it fell victim to fraud in a statement to Bleeping Computer, but said its customers were not financially impacted.
"The fraud case is known and dates back to 2023. Due to technical issues at a service provider, unauthorized direct debits were made from customer accounts. There was no financial loss to customers. We cooperated closely and extensively with the authorities," a Commerzbank spokesperson said.
A Brazilian court also ordered the seizure of around R$106 million ($20 million) in financial assets, vehicles, and real estate. One of the identified suspects reportedly ran for office in 2024 and used some of the stolen funds to finance his campaign.
