Hackers infiltrated Sinqia, a financial technology provider owned by Evertec, targeting its systems to execute unauthorized transfers via Pix, Brazil’s instant payment platform. The cybercriminals attempted to steal approximately 420 million reais ($77.4 million) from multiple Brazilian financial institutions, including HSBC’s local operations. While Sinqia confirmed the breach, it clarified that no suspicious activity was detected beyond the Pix system, suggesting the attack was contained before funds were successfully diverted. The incident highlights vulnerabilities in digital payment infrastructures and the growing sophistication of financially motivated cyberattacks in the banking sector. No evidence of broader system compromise or data exfiltration was reported, but the attempted theft underscores the high-stakes risks associated with real-time payment networks.

Hackers breached Sinqia S.A., a Brazilian subsidiary of Evertec, gaining unauthorized access to its environment on Brazil’s Central Bank real-time payment system (Pix) on August 29, 2025. The attackers exploited stolen credentials from an IT vendor’s account to attempt unauthorized business-to-business transactions, targeting $130 million across two financial institutions (including HSBC, per local media). While part of the funds were recovered, the full financial and reputational damage remains unclear. Sinqia’s Pix access was revoked by the Central Bank, disrupting operations for 24 financial institutions relying on its infrastructure. No personal data was exposed, but the incident triggered forensic investigations and regulatory scrutiny. The attack highlights vulnerabilities in third-party vendor security and the risks of real-time payment system exploits, with potential material financial and reputational consequences for Sinqia and Evertec.