Hackers Launch $130M Heist on Financial Tech Firm, Exploit Vulnerabilities to Access Bank Assets

technology firm Sinqia S.A., a subsidiary of Evertec, experienced a major attempted theft of $130 million via its access to Brazil's Pix payment system.">

September 3, 2025

São Paulo, Brazil – Hackers recently attempted to steal $130 Million from Sinqia S.A., a Brazilian subsidiary of financial technology giant Evertec, Inc., targeting the nation’s Central Bank real-time payment system, Pix. The breach, detected on August 29, 2025, underscores the escalating threat landscape facing financial institutions globally.

The Breach And Its Immediate Aftermath

Evertec promptly disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), detailing how unauthorized activity was identified within Sinqia’s Pix habitat. promptly upon discovering the incursion, Sinqia halted all transaction processing through Pix and initiated collaboration with external cybersecurity specialists to contain the damage and investigate the attack.

The compromised access point was traced back to stolen credentials belonging to an IT vendor with access to Sinqia’s systems. Hackers aimed to execute illicit business-to-business transactions involving two financial institutions utilizing Sinqia’s services. While HSBC bank was reportedly implicated in local media reports, a bank spokesperson clarified that customer funds and data remained secure.

Pix: A Prime target For Cybercriminals

Brazil’s Pix system, launched in November 2020, has quickly become the dominant payment method in the country, facilitating 24/7 instant fund transfers. Its rapid adoption,however,has also attracted notable attention from cybercriminals. The system has been consistently targeted by Android banking malware, such as PixPirate, which employs sophisticated tactics to evade detection.

According to recent data from the Brazilian Federation of banks (Febraban), Pix processed over 14.8 billion transactions in the first half of 2024 alone, totaling more than $340 billion. This widespread usage presents a large attack surface for malicious actors.

Recovery Efforts And Ongoing Investigation

Evertec has confirmed that a portion of the attempted $130 million theft has been recovered,though the exact amount has not been disclosed. Recovery operations are still underway. Currently, the Central Bank of Brazil has suspended Sinqia’s access to the Pix system while the company provides assurances and addresses security concerns.

Evertec maintains that the impact appears to be limited to Sinqia’s Pix operations and that there is no evidence of personal data compromise. However, the company acknowledges that the financial and reputational repercussions of the incident could be substantial. Sinqia’s Pix environment currently supports operations for 24 Brazilian financial institutions.

Key Fact	Details
Attempted Theft Amount	$130 Million
Targeted System	Brazil’s Pix real-time payment system
Compromised Entity	Sinqia S.A. (Evertec Subsidiary)
Access Method	Stolen IT Vendor Credentials
Current Status	Recovery efforts ongoing; Sinqia access to Pix suspended

The Growing Threat of Financial System Attacks

Cyberattacks targeting financial institutions are becoming increasingly sophisticated and frequent. According to a recent report by IBM,the financial services industry experienced a 13% increase in data breaches in 2024 compared to the previous year. These attacks range from ransomware and phishing scams to advanced persistent threats (apts) conducted by state-sponsored actors.

Did You Know? Multi-factor authentication (MFA) can reduce the risk of credential-based attacks by up to 99.9% according to Microsoft.

Pro Tip: Regularly review and update vendor access controls to minimize the potential for breaches through third-party vulnerabilities.

Frequently Asked Questions About The Sinqia Hack

• What is the Pix system? Pix is Brazil’s instant payment system, allowing for 24/7 fund transfers between individuals and businesses.
• How much money was actually stolen in the sinqia hack? While the attempted theft was $130 million, Evertec reports a portion has been recovered, the exact amount is undisclosed.
• Is my personal data at risk? Evertec states there is currently no evidence that personal data has been compromised.
• What is Evertec doing to prevent future attacks? Evertec is working with cybersecurity experts to strengthen its systems and improve security protocols.
• Are other Brazilian banks at risk? While the attack was focused on Sinqia, the incident highlights the broader vulnerability of the Pix system.
• What are IT vendor credentials? These are the usernames and passwords used by third-party IT companies to access a company’s systems for maintenance and support.
• What is the role of the Central Bank of Brazil in this situation? The Central Bank of Brazil has suspended Sinqia’s access to the Pix system until security concerns are addressed.

What are yoru thoughts on the increase in cyberattacks targeting financial institutions? Share your comments below, and be sure to share this article with your network!

how could the implementation of robust multi-factor authentication (MFA) have potentially prevented the initial access gained by attackers?

The Anatomy of a $130 Million Cyberattack

A major financial technology firm recently fell victim to a refined cyberattack resulting in the theft of $130 million in bank assets. The breach highlights the escalating threat landscape facing the fintech industry and the critical need for robust cybersecurity measures. Initial reports indicate the attackers exploited several key vulnerabilities within the firm’s infrastructure, gaining unauthorized access to sensitive financial data and ultimately facilitating the large-scale transfer of funds. This incident underscores the importance of proactive threat detection and rapid incident response.

Identifying the Exploited Vulnerabilities

While a full forensic analysis is ongoing, preliminary findings point to a multi-pronged attack vector. Key vulnerabilities exploited include:

Weak Password Policies: According to CISA’s top cybersecurity best practices, strong passwords are basic. The attackers reportedly gained initial access through compromised credentials, suggesting inadequate password complexity requirements or a lack of multi-factor authentication (MFA).

Unpatched Software: Outdated software with known security flaws provided entry points for the attackers.Regular vulnerability scanning and timely patching are crucial for mitigating this risk.

API Security Weaknesses: The fintech firm relied heavily on Application Programming Interfaces (APIs) to connect with various banking institutions. Poorly secured APIs allowed attackers to bypass customary security controls and directly access bank assets.

Insufficient Data Encryption: Sensitive financial data was not adequately encrypted, making it easier for attackers to decipher and exploit onc access was gained. Data encryption both in transit and at rest is a fundamental security best practice.

lack of Network Segmentation: A flat network architecture allowed the attackers to move laterally within the system, escalating their privileges and accessing critical assets. Network segmentation limits the blast radius of a breach.

The Attack Timeline: A Step-by-Step Breakdown

Understanding the attack timeline is crucial for learning from this incident and improving future defenses.

1. Initial Access: Attackers gained access through compromised credentials, likely obtained via phishing or credential stuffing attacks.
2. Reconnaissance: Once inside the network, the attackers conducted reconnaissance to map the system, identify valuable assets, and locate vulnerabilities.
3. Exploitation: Exploited vulnerabilities in unpatched software and APIs to gain elevated privileges.
4. Lateral Movement: Moved laterally through the network, bypassing security controls and accessing critical systems.
5. Data Exfiltration & Fund Transfer: Accessed bank accounts and initiated fraudulent fund transfers, totaling $130 million.
6. Covering tracks: Attempted to erase logs and cover their tracks to delay detection.

Real-World Implications & Case Studies

This incident echoes previous high-profile financial cyberattacks, such as the 2016 Bangladesh Bank heist, where attackers stole $81 million via the SWIFT network. These events demonstrate the sophistication and persistence of cybercriminals targeting the financial sector. The recent attack on ION Group in March 2023, impacting several financial institutions, also highlights the interconnectedness of the fintech ecosystem and the potential for cascading effects from a single breach.

Benefits of Proactive Cybersecurity Measures

Investing in proactive cybersecurity isn’t just about preventing attacks; it’s about protecting your reputation, maintaining customer trust, and ensuring business continuity.

Reduced Financial Losses: Preventing a successful attack avoids the direct financial costs associated with data breaches, including stolen funds, legal fees, and regulatory fines.

Enhanced Reputation: A strong security posture builds trust with customers and partners, enhancing your brand reputation.

Improved Compliance: Proactive security measures help organizations comply with industry regulations such as PCI DSS, GDPR, and CCPA.

Business continuity: Robust security controls ensure business operations can continue even in the event of an attack.

Practical tips for fintech Firms to Enhance Security

Here are actionable steps fintech firms can take to strengthen their cybersecurity defenses:

Implement Multi-Factor Authentication (MFA): Enforce MFA for all users, especially those with access to sensitive data.

Regular Vulnerability Scanning & Patch Management: Conduct regular vulnerability scans and promptly patch software vulnerabilities.

Strengthen API Security: Implement robust authentication, authorization, and rate limiting for all APIs.

Data Encryption: Encrypt sensitive data both in transit and at rest.

Network Segmentation: Segment the network to limit the blast radius of a breach.

Incident Response Plan: Develop and regularly test a complete incident response plan.

Employee Training: Provide regular cybersecurity awareness training to employees.

Threat Intelligence: Leverage threat intelligence feeds to stay informed about emerging threats.

Regular Security Audits: Conduct regular security audits to identify and address vulnerabilities.

Back Up data: Regularly back up critical data to ensure business continuity in the event of a ransomware attack or data loss. (CISA recommends regular data backups).

Related Search Terms

Fintech cybersecurity

Cybersecurity threats to financial institutions

API security vulnerabilities

Data breach prevention

Incident response planning

financial fraud prevention