Portuguese 
English 
Spanish 
2 min of reading 
0 comments 
Hackers Invade Company Linked to Pix and Divert R$ 400 Million from Accounts at the Central Bank. Understand How the Attack Happened and Which Institutions Were Affected.
On last Tuesday (1st), a large-scale hacker attack hit the systems of C&M Software, the company responsible for connecting banks to the Pix and the Brazilian Payment System (SPB). The estimated damage is at least R$ 400 million.
How the Attack Happened?
According to investigations, the criminals used C&M as a sort of “gateway” to invade the reserve accounts of at least five financial institutions held at the Central Bank. This was made possible through the misuse of customer credentials, according to the company itself.
C&M acts as an intermediary between banks and the Pix settlement system, enabling transactions to occur in real-time. Upon detecting the invasion, the Central Bank disconnected the company from its network as a security measure.
-
SpaceX sets share price at $135 and targets a historic $75 billion IPO to debut on Nasdaq with a trillion-dollar market value
-
While the world rushes to mine lithium from Congo and Chile, Brazil sits on one of the largest reserves and has barely begun to explore.
-
Heir worked at thirteen in an ice cream factory without revealing he was the owner’s son; today, at twenty-five, he leads the best-selling ice cream brand for home consumption in the Northeast, grosses almost R$ 300 million, has 145 stores, and competes with multinationals with regional flavors.
-
Lock manufacturer from Rio Grande do Sul invests R$ 150 million to surpass R$ 1 billion in revenue, create 200 jobs, and double storage capacity, while choosing Santa Catarina to set up a new logistics center and speed up deliveries in Southern Brazil.
The Authorities’ Response
Both the São Paulo Civil Police and the Federal Police are investigating the case, which is considered highly complex and sensitive as it involves accounts directly linked to the Central Bank.
The company, in turn, stated that its critical systems continue to function normally and that all security measures have been taken according to protocols. However, it did not provide additional details, citing respect for the ongoing investigations.
Who Was Affected?
Among the affected institutions is Banco BMP, which confirmed that money was diverted from its account at the Central Bank. In a statement, BMP assured that no customer was impacted and that the loss was limited to the operational resources of the institution itself.
The bank also reported that it has sufficient guarantees to cover the losses and that its operations continue normally, without compromising partnerships or user safety.
What This Means for Pix Users
Despite the scare, no end customer has been directly affected so far. The Pix system continues to function normally. The incident raises an alert about the importance of cybersecurity in critical financial systems and shows that even essential intermediaries in the payment system can be targets of sophisticated attacks.
Tips for Protecting Yourself in the Digital World:
- Use strong and different passwords for each service
- Activate two-factor authentication whenever possible
- Be suspicious of links and emails
- Keep your devices updated
Be the first to react!