Police have arrested eight men suspected of stealing £1.3m from a branch of Barclays Bank. According to the Metropolitan Police Central e-Crime Unit (PCeU), the men allegedly stole the money from the Swiss Cottage branch of the bank in April of this year.

The PCeU said that a keyboard, video and mouse (KVM) switch was attached to a 3G router in order to hack the bank’s computers. The theft is being linked to a similar case last week which led to the arrests of a dozen men, some of whom have now appeared in court over the attempt to take control of computers at a branch of Santander bank. Indeed, I suspect prior police knowledge of this incident may have actually been pivotal in avoiding a recurrence at Santander.

The men, aged from 24 to 47, were arrested on Thursday and Friday. Det Supt Terry Wilson said the investigation was being conducted by the same team that looked into the Santander case but also said that these latest arrests, “are a different level, it’s really the top tier of this criminal network that have been arrested.”

One of those arrested is said to have posed as an IT engineer who was on the premises to fix computer equipment. It is believed that he may have placed the KVM switch on one of the branch’s computers at this time – April 4 – which was the day before the theft was reported.

Once the switch was installed, money was illicitly transferred to other bank accounts, though one perhaps would wonder why Barclays’ internal systems failed to flag up such activity? Not only that but I do worry how a financial institution could let an unauthorised ‘IT engineer’ get close to their systems too. Whatever happened, I would hazard a guess that there are sure to be some security lessons to be learned, both technical and on the human side.

Following the arrests, police raided several addresses in and around the London area from which they seized cash, items of jewelry, credit cards and drugs.

“These arrests were achieved working in partnership with the Virtual Task Force (VTF), an unique information sharing cyber collaboration between the PCeU and the UK Banking sector,” said Det Insp Mark Raymond, Metropolitan Central e-Crime Unit, “Those responsible for this offence are significant players within a sophisticated and determined Organised Criminal Network, who used considerable technical abilities and traditional criminal know-how to infiltrate and exploit secure banking systems.”

Speaking for Barclays Bank, Alex Grant, Managing Director, Fraud Prevention said,

“Barclays has no higher priority than the protection and security of our customers against the actions of would-be fraudsters. We have been working closely with the Metropolitan Police following a security breach at our Swiss Cottage branch in April 2013. We identified the fraud and acted swiftly to recover funds on the same day. We can confirm that no customers suffered financial loss as a result of this action.”

Even though Barclays have recovered a significant amount of the stolen money I wonder what it does for your confidence in the banking system, given that it is the second high-profile example of the same attack vector disclosed this month?

What lessons do you think could be learned here in terms of computer and physical security?