Skip
CYBER TARGET
EN ▾

← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD

Ciberseguridad financiera en Brasil: C&M, Sinqia y nuevas reglas

Los ataques a C&M Software y Sinqia expusieron el riesgo de los proveedores en Brasil. Qué cambiaron las Resoluciones BCB 498 y CMN 5.274 y lecciones.

In just over two months of 2025, criminals used legitimate credentials to divert hundreds of millions of reais from Brazilian financial institutions. The targets were not the banks themselves but technology providers that connect them to Pix and the Brazilian Payment System.

C&M Software

From around 4:30 am on 30 June 2025, Pix transfers began flowing from the account of BMP, a client of C&M Software (Baguete). São Paulo police estimated R$541 million was sent to accounts at other institutions, and a court froze R$270 million in one receiving account (CNN Brasil). A C&M IT operator arrested on 3 July confessed to selling his login and password for R$15,000. The company said the incident involved social engineering, not a system flaw.

Sinqia/Evertec

On 29 August 2025, attackers accessed the Pix environment of Sinqia, owned by US-based Evertec, using compromised IT staff credentials. According to Evertec's SEC filing, cited by Canaltech, about R$710 million was diverted (R$670 million from HSBC and R$41 million from fintech Artta), and about 83% was blocked. The Central Bank suspended Sinqia's Pix connection pending new security measures.

Regulatory response

  • September 2025: BCB Resolution 498 requires accreditation of IT service providers connected to the national financial network, with R$15 million minimum capital, dedicated cybersecurity and crisis directors, 24/7 fraud monitoring with the ability to halt all transactions, audit trails, penetration tests, certification, annual external audits and insurance (Machado Meyer). Resolutions 496 and 497 imposed a R$15,000 per-transaction cap on Pix and TED for institutions connected through such providers until accreditation; in January 2026 the adaptation period was extended to eight months (Jornal de Brasília).
  • December 2025: CMN Resolution 5,274 and BCB Resolution 538 set a 1 March 2026 deadline for multi-factor authentication on network communications (especially Pix and STR), annual independent penetration tests, controls over third-party systems, a ban on third-party access to private keys, environment isolation and credential monitoring (Finsiders).

The December rules also classify electronic data communication with the national financial network as a relevant service for outsourcing purposes, subject to risk management standards and Central Bank supervision. Specialists quoted by TI Inside highlighted the requirement for a director responsible for cybersecurity, segregation of duties and the need to produce auditable evidence for the supervisor. On the same day the C&M operator was arrested, the Central Bank allowed the company to resume partial operations only on business days and within restricted hours, conditional on participating institutions' express consent and reinforced fraud monitoring (Baguete). A commentary in TI Inside noted that the attacks of the period followed a common pattern: valid credentials, high-value payment orders and rapid dispersal of funds, partly into crypto assets.

Lessons

  1. Valid credentials are the new break-in: MFA and behavioural monitoring are essential.
  2. Vendors are the weakest link: third-party due diligence is now a regulatory matter.
  3. Blocking speed matters: most Sinqia funds were frozen.
  4. Insiders are targets: segregation of duties and access monitoring reduce the risk.

Fuente

+

EN · PT · ES · FR · ZH · AR