Cyberattack on Brazil tech provider affects reserve accounts of some financial institutions

The Hindu

03-07-2025

Brazil's central bank said on Wednesday that technology services provider C&M Software, which serves financial institutions lacking connectivity infrastructure, had reported a cyberattack on its systems.
The bank did not provide further details of the attack, but said in a statement that it ordered C&M to shut down financial institutions' access to the infrastructure it operates.
C&M Software commercial director Kamal Zogheib said the company was a direct victim of the cyberattack, which involved the fraudulent use of client credentials in an attempt to access its systems and services.
C&M said critical systems remain intact and fully operational, adding that all security protocol measures had been implemented. The company is cooperating with the central bank and the Sao Paulo state police in the ongoing investigation, added Zogheib.
Brazilian financial institution BMP told Reuters that it and five other institutions experienced unauthorised access to their reserve accounts during the attack, which took place on Monday.
BMP said the affected accounts are held directly at the central bank and used exclusively for interbank settlement, with no impact on client accounts or internal balances.
BMP added it has taken all necessary operational and legal steps and holds sufficient collateral "to fully cover the impacted amount, without any harm to its operations or business partners."
An official familiar with the ongoing investigation, who spoke on condition of anonymity, said C&M provides services to around two dozen small financial institutions, and the amounts involved in the attack do not reach into the billions of reais.
Another source said there were no losses suffered by clients.
The central bank has used the term "financial institutions lacking their own connectivity infrastructure" to refer to digital payment institutions, which have grown rapidly in Latin America's largest economy, boosted by innovations driving competition in the sector.
For instance, the Pix instant payment system, developed and operated by the central bank, was launched in late 2020 and has become the most widely used payment method in the country.