By Brazil Stock Guide – Hackers stole at least R$400 million (US$72 million) on Aug. 29 after breaching the Pix payment environment operated by Sinqia, a Brazilian banking software provider acquired by Evertec (NYSE: EVTC). HSBC Holdings was cited in market reports as the main institution affected, but there has been no official confirmation.
Sinqia said it detected suspicious activity the same day and launched an immediate investigation with forensic experts. According to the company, the breach was isolated to its Pix system and did not affect other platforms or compromise personal data. The information was first reported by Neofeed.
The incident mirrors the July assault on C&M Software, where hackers siphoned over R$1 billion. Both cases underscore weaknesses in the banking-as-a-service chain linking banks and fintechs to Brazil’s instant payment system.
Sinqia isolates systems
In a statement, Sinqia said that on Aug. 29 it detected suspicious activity in its Pix system. “Our team acted swiftly and launched an investigation to identify the cause. We’re already in touch with affected clients, which involve a limited number of financial institutions,” the company said. “At this time, we confirm the breach is confined to the Pix system. We have no indication that any personal data was compromised.”
The company added it disconnected Pix from Brazil’s central bank network and started rebuilding the platform in a new, more secure environment. Full restoration will require central bank approval. Neither HSBC nor the Central Bank has commented so far.
Sinqia — formerly listed on B3 as SQIA3 — was acquired by Evertec (NYSE: EVTC) in October 2023, in a deal valued at approximately US$591 million (about R$2.8 billion).
Leave a Reply