More details on emptied safe deposit boxes – Austria

The perpetrators gained entry into the financial institutions by previously manipulating the access system. A lead to the perpetrators could lead to Sweden.

In a concerted action, a total of six people attacked the automatic safe systems in the three banks on November 13 from 6:00 p.m. to 11:14 p.m. 31 lockers were emptied from a Bank Austria branch in Klosterneuburg (Tulln district), 29 from the Mödlinger Raiffeisen regional bank and eight from a Raiffeisen branch in Vienna-Döbling.

The perpetrators left the objects with bags or rucksacks in their luggage. Inside were jewels, gold, watches, and cash. Police spokesman Johann Baumschlager did not provide precise information on the value of the stolen property when asked. The “courier” reported around 25 million euros. This sum could not be confirmed by far, not all injured parties had already been questioned, so the Lower Austria police.

The procedure should have been the same at all three crime scenes. According to this, it has so far been ascertained that the perpetrators had already started several weeks earlier using so-called skimming to copy the cards of authorized customers both at the entrance to the secret room and at the terminal of the immediate locker system. For this purpose, a copy module that is not visible from the outside is installed in the input slot, which successively records the information on the magnetic strip and is then read out by the perpetrators in order to make 1: 1 copies.

The PIN codes belonging to the cards were then apparently filmed by hidden cameras when the later victims accessed their compartments. Shortly before access to the lockers on November 13, 2020, the perpetrators dismantled all installations. Overcoming the access control and the PIN hurdle became an easy game for the criminals. They then requested the lockers from the vault and opened some of them by force.

According to “Salzburger Nachrichten (SN)” (Friday edition), one possible lead to the perpetrators leads to Sweden. According to this, there was a cyber attack in mid-August on the headquarters of the global company “Gunnebo” in Gothenburg, which specializes in integrated security solutions. The Linz cybersecurity expert Jürgen Weiss told the “SN” that “masterkey” passwords for the access systems to the automatic safe system, with which computers could be controlled externally, may have been withdrawn.

In a similar way, perpetrators had already cleared lockers in Switzerland and Germany, reported the “SN”. Baumschlager confirmed to the APA that the investigators were aware of cases in Switzerland and northern Germany in which the perpetrators followed a similar modus operandi. According to the police spokesman, the criminologists examine the connections in this regard.

According to “SN”, a statement has now been published on the “Gunnebo” website: “It is now clear that certain data from this ransomware attack was captured and made accessible via the Darknet.” “Gunnebo” spokeswoman Isabelle Ljunggren announced on Thursday that the company had immediately opened an internal investigation. This showed that there was “no indication of a connection between the IT incident discovered in August and the skimming attack on customers of the automatic safe deposit box system”.

“The investigations of the state criminal investigation offices in Vienna and Lower Austria are still in full swing,” said the investigators. It is generally assumed that there are more than six suspects. In addition to the perpetrators visible on video recordings, there could also be possible drivers of escape vehicles and any IT specialists working in the background.

There were also details about the thefts in the Lower Austrian financial institutions: Two masked men can be seen on the surveillance videos from Klosterneuburg. However, the investigators assume a third perpetrator who was sitting in a car parked nearby. The car must have been parked in the area of ​​the town square and at the Park & ​​Ride facility at the train station or on the gravel parking lot “In der Au”.

One of the perpetrators in Klosterneuburg left the bank with an apparently fully packed bag at 7:34 p.m. in the direction of the town square (after the exit to the left) and returned without this bag at 7:37 p.m. At 11:18 p.m. the two locker intruders came out of the bank and then walked towards the Park & ​​Ride facility or gravel parking lot “In der Au” (after the exit to the right).

With regard to the Mödlinger Bank, which was also damaged, the police announced that a dog owner who had been searched for by means of a media call had meanwhile reported. He then confirmed that one of the perpetrators was actually a woman. He was still amazed at the thick clothing and disguise of the two people because the clothing was not adapted to the pleasant temperatures prevailing at the time.

According to the investigators, the criminals apparently left the bank to the left and immediately left again into Freihofgasse towards Franz-Keim-Gasse. The escape vehicle may have been parked here or further on in Demelgasse or at the train station. Here, too, the investigators consider a third perpetrator as a driver possible. “We would like to point out the suspicious jacket of the perpetrator (brand Naketano). It would also be interesting for the police whether this couple has taken accommodation in an accommodation facility or in another rental facility, since the perpetrators have probably been preparing the act for several weeks “, it said in a broadcast.