Glossary term
Threat actor
A threat actor is an individual or a group that poses a threat to an organization or system.
Read more
Significant cyber incident
Pix payment provider theft, Brazil, 2025
In short
On 1 July 2025 criminals used login credentials tied to a Brazilian firm that connects financial institutions to the central bank and Pix, to move money out of reserve accounts that banks keep at the central bank. Sources give totals of at least R$ 400 million and at least R$ 530 million. A provider employee was arrested on 4 July after reportedly accepting R$ 15,000 to give access.
What happened
On the night of Tuesday 1 July 2025, criminals attacked the technology infrastructure of a Brazilian provider that connects institutions without their own link to the national payment system, which includes Pix. The attack became public on 2 July, when the central bank said the provider had reported it and ordered institutions disconnected from the infrastructure the provider operates.
The criminals sent orders as if they were authorized institutions, using legitimate credentials. Money left reserve accounts that banks keep at the central bank. It was sent by Pix and converted into cryptocurrency. Customer account balances were not affected, according to the sources.
On 4 July the Sao Paulo Civil Police arrested a provider employee who reportedly took R$ 15,000 to give criminals access. The central bank then suspended six institutions from Pix as a precaution because they were suspected of receiving diverted funds.
Sources differ on the amount. Agencia Brasil cited at least R$ 400 million on 3 July and at least R$ 530 million on 5 July. A parliamentary request cited reports of possible losses of up to R$ 1 billion.
Timeline
-
1 July 2025
Night attack on the provider's infrastructure using leaked or legitimate credentials; money moves out of reserve accounts at the central bank
-
2 July 2025
Central bank confirms the provider reported an attack and orders institutions disconnected from the provider's infrastructure; Federal Police announce an investigation
-
2 July 2025
The provider says it is a direct victim and that critical systems are intact
-
3 July 2025
Central bank replaces full suspension of the provider with a partial one; Pix operations restart under controlled production
-
3 July 2025
The provider says no customer or institution data was leaked and it is reviewing external access and API policy
-
3 July 2025
A member of the Chamber of Deputies files an information request to the finance minister about the attack
-
4 July 2025
Sao Paulo Civil Police arrest a provider employee; central bank suspends three institutions from Pix
-
5 July 2025
Central bank suspends three more institutions from Pix, six in total
-
5 September 2025
Central bank caps Pix and TED at R$ 15,000 for some institution types and tightens access rules
How the attack worked
Access through credentials
The central bank and the provider both said the attack used credentials. Agencia Brasil reported that the criminals used leaked credentials of the provider’s clients, such as login and password. The provider described the attack as a fraudulent simulation of integration: it used legitimate credentials of a client to reach services as if it were an authorized institution. The provider also said responsibility for credentials lies with the institution that holds them.
An insider, according to police
The Sao Paulo Civil Police arrested a provider employee who received R$ 15,000 to give criminals access to the company’s systems. Reports say he confessed to supplying an access password for R$ 5,000 and receiving R$ 10,000 more to create an access system for the hackers. These are statements reported by Agencia Brasil, not court findings. The roles of credentials of clients and of the employee’s access are not fully set out in the sources, so they are not reconciled here.
Moving the money
The orders drew down reserve accounts that banks hold at the central bank to meet legal reserve rules. The money was transferred by Pix and converted into cryptocurrency. Pix itself was not reported as the point of failure, and customer data was not reported as taken.
- Get accessCredentials of a client, and per police an employee’s access, usedTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- ImpersonateOrders sent as if from authorized institutions
- DrainReserve accounts at the central bank debited
- Cash outFunds sent by Pix and converted to crypto
ATT&CK techniques
Who says who was behind it
No public attribution to a named threat group. The Sao Paulo Civil Police arrested a provider employee on 4 July 2025 (Agencia Brasil, 4 July 2025). The individual is not named here, and the statements about payment are reports of what he said, not court findings. The sources do not name the criminal group behind the attack.
Impact
Money taken from reserve accounts at the central bank. Sources differ on the total: at least R$ 400 million (EBC, 3 and 4 July 2025), at least R$ 530 million (TV Brasil, 5 July 2025), and possible losses of up to R$ 1 billion cited in a parliamentary request of 3 July 2025.
Customer balances were not affected, according to Agencia Brasil and the institutions cited in the request. The provider said no data of customers or institutions was leaked.
the provider's Pix service was cut off on 2 July and restarted on 3 July in limited form. Six institutions suspected of receiving diverted funds were suspended from Pix for up to 60 days. The provider said part of the money came back through the MED return mechanism, but gave no figure.
Government and regulator response
- 2 July 2025: the central bank ordered institutions disconnected from the provider’s infrastructure. The Federal Police opened an investigation.
- 3 July 2025: the central bank allowed a partial restart (business days, 06:30 to 18:30, with consent of each Pix participant, stronger fraud monitoring and transaction limits). The provider said it adopted stronger internal controls and independent audits, and would raise approval standards for clients and review external access and API policy.
- 4 and 5 July 2025: the central bank suspended six institutions from Pix as a precaution under Article 95-A of Resolution 30. The Sao Paulo Civil Police arrested a provider employee.
- 5 September 2025: the central bank capped Pix and TED at R$ 15,000 for institutions not authorized by it and firms connecting through IT service providers, brought forward the authorization deadline to May 2026, and set minimum capital of R$ 15 million for IT service providers. A board vote of 3 September said recent cyber attacks showed the need for adjustments.
Lessons
-
Credentials are the key
The attack worked through credentials, not a reported software flaw. Protect and monitor every credential that can send payment orders.
-
Insiders are a real route
Police said an employee was paid for access. Limit what one person can do and review privileged use.
-
Suppliers connect many institutions
One connection provider linked several institutions. A weakness there can reach many reserve accounts at once.
-
Limits and monitoring slow thieves
The central bank made fraud monitoring and transaction limits a condition of restart. Set limits on high-value orders.
-
Fast detection helps recovery
The provider said fast identification raised the return rate. Plan for rapid freezing and recall with partners.
-
Rules followed the incident
The central bank tightened access and capital rules for IT service providers. Expect suppliers to face stricter checks.
What to check in your own organization
-
Who can send payment orders
List every credential, API key and user that can instruct settlement or high-value payments and who holds it.
-
Approval for large orders
Check that large or unusual orders need a second approver and cannot be raised by one account.
-
Supplier access
Review how your connection providers authenticate you and how they separate clients.
-
Credential leaks
Search for leaked or reused logins of staff and of clients with access to your systems.
-
Insider risk
Review leaver, privileged-access and conduct checks for staff with payment system access.
-
Monitoring and limits
Confirm transaction limits, time windows and alerts exist for after-hours and bulk orders.
-
Recall plan
Rehearse how you would freeze funds and recall transfers within hours, including to crypto platforms.
Where it happened
- Country Brazil Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
Questions
What was the affected provider?
A Brazilian technology provider approved by the central bank that connects institutions without their own link to the national payment system, which includes Pix.
How much was taken?
Sources differ: at least R$ 400 million (3 July 2025), at least R$ 530 million (5 July 2025), and possible losses of up to R$ 1 billion cited in a parliamentary request.
Were customer accounts affected?
Not according to the sources. The money came from reserve accounts that banks hold at the central bank, and the provider said no customer data was leaked.
How did the criminals get in?
By using credentials. The Sao Paulo Civil Police arrested a provider employee who reportedly took R$ 15,000 to give access.
Was Pix hacked?
The sources describe credentials misused at a connection provider. Pix transfers were used to move the money, but Pix itself was not reported as the point of failure.
What did the central bank do?
It disconnected the provider, allowed a limited restart on 3 July, suspended six institutions from Pix, and in September 2025 tightened rules for payment institutions and IT service providers.
Sources
- PF investigara ataque hacker a empresa que atende bancos Agencia Brasil (EBC)
- Empresa alvo de ataque hacker volta a operar com autorizacao do BC Agencia Brasil (EBC)
- Ataque hacker nao envolveu extracao de dados de clientes, diz empresa Agencia Brasil (EBC)
- BC suspende tres instituicoes do Pix apos ataque cibernetico Agencia Brasil (EBC)
- Banco Central susupende mais tres instituicoes financeiras do Pix Agencia Brasil (EBC)
- BC endurece regras de seguranca para instituicoes de pagamento Agencia Brasil (EBC)
- Requerimento de Informacao RIC 4074/2025 Camara dos Deputados
- Voto 109/2025-BCB, de 3 de setembro de 2025 Banco Central do Brasil
- Brazilian police arrest IT worker over $100 million cyber theft The Record, July 2025
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.