Operation Klonen: Dual-Control Recovery After a Payment-Provider Attack

German and Brazilian authorities have announced enforcement actions tied to a November 2023 payment-provider attack that Brazilian police says caused an estimated €30 million in losses at a German financial institution. Germany's BKA says a vulnerability introduced by a faulty software update in a payment provider's booking process enabled numerous unauthorized debits during a four-day window. The August 2026 actions identified three suspects in Europe and arrested four alleged members of the network in Brazil.

This is a confirmed cross-border law-enforcement development, not a newly discovered breach. The attack occurred in 2023; the current event is the coordinated action announced by the BKA and Brazil's Polícia Federal. The provider and bank are not named in either official release, and the public evidence does not say that credentials or cryptographic keys were stolen.

What the German and Brazilian authorities confirm

The BKA and Frankfurt's cybercrime prosecution office say the attackers exploited a flaw created by an incorrect software update at a payment service provider. The booking-process weakness was used immediately and allowed unauthorized withdrawals from German online banking users over four days in November 2023. The BKA describes the damage as being in the millions of euros.

Brazil's Polícia Federal says the German financial institution estimated its loss at approximately €30 million. Its Operation Klonen executed 21 search warrants across seven cities and four preventive arrest warrants. Brazilian courts also authorized seizure of financial assets, vehicles and property up to approximately R$106 million.

Authorities say funds were moved and concealed through payment cards issued without the beneficiaries' consent, intermediary accounts, companies, payment institutions and virtual-asset platforms. The BKA says part of the money also moved through four European countries. Those are investigative findings and allegations against suspects, not final judicial determinations.

What should not be inferred

The Record notes German media reports associating the 2023 incident with Commerzbank, but neither official announcement names the bank. That attribution should therefore remain reported, not presented as an official fact. The sources also do not identify the payment provider, publish a CVE, describe the vulnerable code path or establish how many customers experienced an unauthorized debit.

Most importantly for credential response, a software flaw is not proof that passwords, signing keys or API tokens were exposed. Teams should investigate the actual trust paths before rotating secrets; indiscriminate emergency changes can create outages and may place replacement credentials back into a still-untrusted integration.

A payment provider is part of the bank's trust boundary

Payment processing depends on more than a network connection. Institutions exchange API credentials, certificates, signing material, service accounts, routing identifiers and operational approvals. A provider-side failure can affect transactions even when the bank's customer-facing application is functioning normally.

That does not mean every integration secret was compromised in Operation Klonen. It means those dependencies belong in the incident inventory. The response team needs to know what the provider could execute, which identities were trusted, how transactions were authorized and which controls can stop activity without destroying the evidence needed to reconstruct it.

A controlled recovery sequence for financial integrations

Freeze the affected transaction path. Use established fraud and continuity procedures to limit further unauthorized activity without relying on instructions received through the suspected integration.
Preserve evidence. Retain booking, authorization, identity, API, network and change-management logs from both institution and provider.
Map every trust dependency. Identify service accounts, certificates, API tokens, signing keys, callback endpoints and human approval roles connected to the affected process.
Separate flaw remediation from secret rotation. Fix or isolate the defective software path, then rotate only credentials that were exposed, reachable or cannot be cleared by the available evidence.
Revoke before reissuing. Disable old sessions and credentials before distributing replacements, and use a known-clean administrative path.
Validate with both parties. Reconcile test transactions, verify the deployed version and confirm that monitoring sees the recovered path before restoring normal volume.

Use dual control for crown-jewel recovery secrets

No single person should be able to request, approve and receive a high-impact payment credential during an emergency. Require separate approval for changes to transaction signing, settlement, reconciliation or provider administration. Confirm the recipient through a directory and callback route that does not originate in the same email or chat requesting the change.

Replacement values should be narrowly scoped, short-lived where supported and recorded as rotated without recording the plaintext itself. For pre-planned break-glass material, threshold release can distribute authority across multiple trusted holders so that one compromised account or coerced operator is insufficient.

Where Secretus fits—and where it does not

Secretus can support an approved handoff of a replacement service password, API token or recovery code after the financial institution and provider verify the people and clean endpoints involved. A short-lived one-time link avoids copying plaintext into a ticket or incident chat; Team Split can support a pre-arranged multi-person release.

Secretus does not secure the payment process, validate a software update, authorize a transaction, detect fraudulent debits or prove that an integration is clean. Do not use it to transfer customer banking data, transaction exports or entire key stores. Its role is limited to reducing durable copies during a verified recovery-secret handoff.

What remains unknown

The official releases do not name the bank or provider, identify a CVE, publish a victim count or explain whether any authentication or signing material was accessible. The €30 million figure is the estimate reported by Brazil's Polícia Federal from the affected institution. The suspects have not been described as convicted, and the investigation continues across several jurisdictions.