Customers of Deutsche Bank and its subsidiary Postbank are affected by the incident, and the bank has alerted an unspecified number of clients that their data may have been stolen. The institute declared that an external service provider's data loss was the thieves' entry point. The service provider found the root of the security breach and fixed it. A software vulnerability has been exploited, according to a letter sent to the affected clients. The bank refrained from identifying the service provider who let the data leak happen. Other banks and their customers may also be impacted because account-switching service providers frequently work with several banks.

A former Computacenter manager has filed suit alleging that unauthorized parties repeatedly accessed Deutsche Bank’s high-security New York datacenter between March and June 2023. Court documents claim that a Computacenter employee allowed his uncredentialed girlfriend into server rooms housing critical mainframe systems, while internal CCTV footage reportedly shows Deutsche Bank’s own security staff permitting her entry. During these breaches, she allegedly connected a personal laptop to the bank network and may have circumvented the SIEM monitoring environment. Despite reporting these lapses and urging a regulatory disclosure, the whistleblower was suspended and ultimately terminated. No confirmed data exfiltration or operational outage has been documented, but the incidents exposed serious lapses in multi-layered physical and logical controls, exposing the institution to heightened regulatory, legal and reputational risk. The lawsuit seeks over $20 million in damages under New York whistleblower protections and highlights the potential downstream costs of litigation, internal investigations and remediation measures to shore up security protocols.

An initial access broker hacked multinational investment bank Deutsche Bank and offered access to its systems for sale on Telegram. The IAB claims to have access to around 21000 machines in the bank’s network, most of which are Windows systems. The breacher had access to the chat services used for internal communications. He also claimed to have access to file servers containing 16 terabytes of data.