Massive $130 million attempted theft targets brazilian Fintech through stolen vendor credentials
Learn More
Evertec's Brazilian subsidiary Sinqia S.A., a financial technology provider in Brazil's payment infrastructure, was hit by a cyberattack on August 29, 2025, that resulted in attempted theft of Brazilian Real (R)$710 million (approximately $130-140 million USD) through Brazil's real-time payment system Pix.
Sinqia, a São Paulo-based financial software and IT services company provides the infrastructure that enables 24 banks and financial institutions to process instant payments through Pix, Brazil's most widely used payment method with 169 million registered users.
The attack was executed with compromised credentials belonging to legitimate IT vendors of Sinqia. The credentials were used to inject unauthorized business-to-business financial transactions into the Pix environment.
The incident targeted HSBC and fintech firm Artta. The hackers tried to steal R$380 million from HSBC and approximately R$40 million from Artta. Evertec's official reports of R$710 million in unauthorized transactions, indicates that other financial institutions were also targeted.
After detecting the unauthorized activity Sinqia halted all transaction processing in its Pix environment and engaged outside cybersecurity forensics experts. The Brazilian Central Bank (BCB) disconnected Sinqia from the national payments infrastructure and blocked the company's access to the Brazilian Payments System (SPB) and Pix until full remediation and regulatory approval.
The Brazilian Central Bank managing to freeze R$350 million of the attempted theft. Additional recovery efforts are ongoing.
