Four cybercriminals were arrested in Brazil and three more were charged in Europe following a joint investigation by the Brazilian Federal Police and Germany’s BKA into a 2023 bank fraud that cost around €30 million ($34.6 million). The attackers exploited a vulnerability at an unnamed service provider, which gave them access to Commerzbank customers’ bank accounts and allowed them to make unauthorized direct debits over a four-day window in November 2023. Brazilian media identified Commerzbank — a major European financial institution with more than €11 billion in annual revenue — as the targeted bank, and Commerzbank confirmed it to BleepingComputer, adding that no customers ultimately suffered financial losses.
The case illustrates how attackers increasingly target the third-party vendors and technology providers that financial institutions rely on rather than attacking banks directly. A single flaw in a shared service provider can create a single point of failure for multiple clients simultaneously. The multi-country arrest operation, with coordination between German and Brazilian authorities, took more than two years from the original incident — a reminder that cyber-enabled financial fraud investigations move slowly but can still result in prosecution.