Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized entry to its atmosphere on the central financial institution’s real-time fee system (Pix).
Evertec is a public monetary expertise big that stands as a significant full-service transaction processor in Latin America, Puerto Rico, and the Caribbean.
Sinqia, acquired by Evertec in 2023, is a SĂŁo Paulo-based public firm working in monetary software program and IT companies for the banking and monetary trade.
Evertec disclosed in a submitting to the U.S. Securities and Trade Fee (SEC) that hackers breached Sinqia’s programs on August 29 and tried to conduct unauthorized transactions.
“On August 29, 2025, Sinqia S.A., a Brazilian subsidiary of EVERTEC, Inc., recognized unauthorized exercise in its atmosphere of the Brazilian Central Financial institution real-time fee system generally known as Pix,” reads the SEC submitting.
“Upon detecting the incident, and in accordance with its incident response protocol, Sinqia halted transaction processing in its Pix atmosphere and started working with exterior cybersecurity forensics consultants.”
Pix is Brazil’s on the spot funds system, launched by the Central Financial institution of Brazil in November 2020, permitting 24/7 on the spot fund transfers.
It has turn out to be essentially the most extensively used fee methodology in Brazil, and is typically focused by Android banking malware.
The hackers tried to carry out unauthorized business-to-business transactions involving two monetary establishments which are clients of Sinqia.
Native media retailers implicated the HSBC financial institution, whereas a spokesperson from the financial institution underlined that this incident has not impacted buyer funds or knowledge.
Evertec notes that a part of the $130 million has already been recovered, with out mentioning how a lot, with restoration efforts nonetheless contining.
Investigation into the incident confirmed that the hackers gained entry to Sinqia’s Pix atmosphere through the use of stolen credentials for an IT vendor’s account.
Evertec has no indication that the affect extends past Sinqia’s Pix atmosphere, and no proof that non-public knowledge has been uncovered.
Presently, Sinqia’s entry to Pix has been revoked by the Central Financial institution of Brazil, however the firm is working in direction of fast restoration by offering all of the required particulars and assurances to the authorities.
Relating to the monetary affect, Evertec notes that Sinqia’s Pix atmosphere helps the operations of 24 monetary establishments in Brazil.
“The monetary and reputational affect of the incident, together with any affect on the Firm’s inner controls, will not be but identified and might be materials,” notes the corporate.
46% of environments had passwords cracked, almost doubling from 25% final yr.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration tendencies.
