Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized entry to its surroundings on the central financial institution’s real-time fee system (Pix).
Evertec is a public monetary expertise big that stands as a serious full-service transaction processor in Latin America, Puerto Rico, and the Caribbean.
Sinqia, acquired by Evertec in 2023, is a São Paulo-based public firm working in monetary software program and IT companies for the banking and monetary business.
Evertec disclosed in a submitting to the U.S. Securities and Alternate Fee (SEC) that hackers breached Sinqia’s techniques on August 29 and tried to conduct unauthorized transactions.
“On August 29, 2025, Sinqia S.A., a Brazilian subsidiary of EVERTEC, Inc., recognized unauthorized exercise in its surroundings of the Brazilian Central Financial institution real-time fee system often known as Pix,” reads the SEC submitting.
“Upon detecting the incident, and in accordance with its incident response protocol, Sinqia halted transaction processing in its Pix surroundings and commenced working with outdoors cybersecurity forensics consultants.”
Pix is Brazil’s prompt funds system, launched by the Central Financial institution of Brazil in November 2020, permitting 24/7 prompt fund transfers.
It has turn out to be probably the most extensively used fee methodology in Brazil, and is typically focused by Android banking malware.
The hackers tried to carry out unauthorized business-to-business transactions involving two monetary establishments which might be clients of Sinqia.
Native media shops implicated the HSBC financial institution, whereas a spokesperson from the financial institution underlined that this incident has not impacted buyer funds or information.
Evertec notes that a part of the $130 million has already been recovered, with out mentioning how a lot, with restoration efforts nonetheless contining.
Investigation into the incident confirmed that the hackers gained entry to Sinqia’s Pix surroundings by utilizing stolen credentials for an IT vendor’s account.
Evertec has no indication that the influence extends past Sinqia’s Pix surroundings, and no proof that private information has been uncovered.
At present, Sinqia’s entry to Pix has been revoked by the Central Financial institution of Brazil, however the firm is working in direction of fast restoration by offering all of the required particulars and assurances to the authorities.
Concerning the monetary influence, Evertec notes that Sinqia’s Pix surroundings helps the operations of 24 monetary establishments in Brazil.
“The monetary and reputational influence of the incident, together with any influence on the Firm’s inner controls, should not but identified and might be materials,” notes the corporate.
46% of environments had passwords cracked, almost doubling from 25% final yr.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and information exfiltration developments.
