Full Report
Hackers tried to steal $130 million from Evertec's Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank's real-time payment system (Pix). [...]
Analysis Summary
# Incident Report: Attempted $130M Bank Heist via Fintech Compromise
## Executive Summary
Hackers successfully breached the environment of Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, via compromised credentials belonging to an IT vendor. The attackers accessed Sinqia’s interface to the Brazilian Central Bank's real-time payment system (Pix) and attempted to execute unauthorized business-to-business transactions totaling approximately $130 million. The incident was detected on August 29, 2025, leading to the halting of Pix processing and ongoing recovery efforts, though the full financial and reputational impact remains unclear.
## Incident Details
- **Discovery Date:** August 29, 2025
- **Incident Date:** August 29, 2025
- **Affected Organization:** Sinqia S.A. (A Brazilian subsidiary of EVERTEC, Inc.)
- **Sector:** Financial Technology (Fintech), Transaction Processing
- **Geography:** Brazil (São Paulo)
## Timeline of Events
### Initial Access
- **Date/Time:** August 29, 2025 (Sometime before detection)
- **Vector:** Compromised credentials belonging to an IT vendor.
- **Details:** Attackers used stolen credentials to gain unauthorized access to Sinqia's environment connected to the Pix instant payment system.
### Lateral Movement
- **Details:** Not explicitly detailed, but movement was confined to Sinqia's Pix environment, allowing access to initiate transactions with two customer financial institutions.
### Data Exfiltration/Impact
- **Impact:** Attempted unauthorized transactions totaling approximately $130 million, targeting business-to-business transfers involving two customer financial institutions (one possibly implicated as HSBC). A portion of the funds was reportedly recovered. No evidence of personal data exposure was found.
### Detection & Response
- **Detection:** Unauthorized activity in the Pix environment was identified by Sinqia on August 29, 2025.
- **Response actions taken:** Sinqia halted transaction processing in its Pix environment immediately, engaged outside cybersecurity forensics experts, and is working with Brazilian authorities to restore access. Sinqia's access to Pix has been temporarily revoked by the Central Bank of Brazil pending assurance.
## Attack Methodology
- **Initial Access:** Usage of stolen credentials (IT vendor account).
- **Persistence:** Not explicitly detailed.
- **Privilege Escalation:** Not explicitly detailed, but access granted sufficient privileges to initiate high-value transactions on the Pix system.
- **Defense Evasion:** Not explicitly detailed.
- **Credential Access:** Theft of IT vendor credentials was the primary entry vector.
- **Discovery:** Not explicitly detailed, though internal reconnaissance would have been necessary to target the Pix transaction environment.
- **Lateral Movement:** Movement was confined or focused primarily within the Pix processing environment.
- **Collection:** Identifying and targeting payment flows within the Pix system.
- **Exfiltration:** Attempted high-value fund transfers via the Pix system.
- **Impact:** Financial loss attempt through unauthorized payments.
## Impact Assessment
- **Financial:** Intended loss of $130 million; some funds have been recovered; the ultimate financial impact, including costs associated with the incident and control remediation, is currently unknown and potentially material.
- **Data Breach:** No indication that personal data has been exposed.
- **Operational:** Temporary halt of Sinqia’s Pix processing operations, affecting 24 financial institutions relying on the system.
- **Reputational:** Potential reputational damage for Evertec/Sinqia due to the attempted large-scale financial heist.
## Indicators of Compromise
- **Network indicators:** Targeting activity related to the Brazilian Central Bank Pix gateway infrastructure. (Note: Specific IPs/domains are not provided and must remain defanged.)
- **File indicators:** None explicitly mentioned.
- **Behavioral indicators:** Initiation of unauthorized, high-value business-to-business transactions through the Pix interface.
## Response Actions
- **Containment measures:** Immediate halting of all transaction processing within the Sinqia Pix environment.
- **Eradication steps:** The environment is under forensic investigation with external cybersecurity experts.
- **Recovery actions:** Working with the Central Bank of Brazil to restore Pix access after providing assurances and required details. Ongoing efforts to recover attempted fraudulent funds.
## Lessons Learned
- **Key takeaways:** Third-party vendor account security (IT vendor credentials) represents a critical vulnerability point leading to direct access to core financial infrastructure (Pix).
- **What could have been done better:** The mechanism allowing vendor credentials to be used for privileged access to the live payment system should be immediately reviewed and hardened (e.g., stronger MFA, least privilege enforcement for vendor access).
## Recommendations
- Immediately implement zero-trust principles and multi-factor authentication (MFA) mandate for all external vendor access, especially for accounts interacting with payment processing systems.
- Conduct a comprehensive audit of all external IT vendor accounts, ensuring their permissions are strictly limited to necessary functions (Least Privilege Principle).
- Enhance monitoring and anomaly detection specifically around the initiation of high-value transactions on the Pix interface, regardless of the originating source IP or user account.