A concerning cyber incident has shaken Brazil’s financial technology sector after criminals attempted to steal nearly $130 million through the country’s real-time payments network, Pix. The breach was detected on August 29, 2025, when Sinqia S.A., a São Paulo-based financial software company owned by Evertec, noticed unauthorized activity in its systems.
What Happened
According to Evertec’s disclosure to the U.S. Securities and Exchange Commission, attackers gained entry into Sinqia’s Pix environment and tried to initiate unauthorized business-to-business transfers. Pix, operated by the Central Bank of Brazil, is an instant payments platform that has become the country’s most widely used method for digital transfers since its launch in 2020.
The attempted theft targeted two financial institutions connected to Sinqia’s services. Once the suspicious activity was detected, Sinqia suspended all Pix-related transactions and brought in external cybersecurity experts to investigate.
How the Attackers Broke In
Initial findings show that the hackers gained access by using stolen credentials belonging to an IT service provider. By leveraging legitimate login details, they were able to penetrate Sinqia’s Pix environment and attempt large-scale transfers. This method, often referred to as a supply chain or vendor compromise, has become increasingly common in financial cyberattacks because it exploits trusted third-party relationships.
So far, Evertec has found no evidence that the breach extended beyond Sinqia’s Pix systems or that customer data was exposed.
Response and Recovery
As a precaution, the Central Bank of Brazil revoked Sinqia’s access to Pix until it can confirm the environment is secure. This suspension directly affects 24 financial institutions that rely on Sinqia to process instant transfers. The company has stated that some of the stolen funds have already been recovered, though it has not disclosed the amount. Recovery efforts are still underway, and the overall financial and reputational impact remains uncertain.
Evertec acknowledged that the consequences could be “material,” particularly in relation to customer trust and the company’s internal controls. Investigations are ongoing, and Sinqia continues to work with regulators and forensic experts to restore secure access to Pix.
Why This Matters
The case stresses upon the risks facing modern payment systems that operate at high speed and high volume. Pix is widely used in Brazil for everything from personal transfers to business payments, making it an attractive target for cybercriminals. By exploiting vendor credentials, attackers can bypass traditional defenses and reach critical financial infrastructure.
For banks, service providers, and regulators, the incident underscores the importance of constant vigilance, strict vendor oversight, and layered defenses against credential theft. For users, it is a reminder of both the convenience and the risks that come with instant payment systems.
Investigations are still unfolding, and more details are expected in the coming weeks as Evertec and Brazilian authorities work to close the breach and strengthen protections.
MathWorks, the company behind MATLAB and Simulink, has confirmed a ransomware attack that disrupted several of its online services and internal systems. The company said the disruption affected services customers use to sign in and manage software, and that it alerted federal law enforcement while investigating the incident.
According to state notifications filed with regulators, the attack resulted in the unauthorized access and theft of personal information for 10,476 people. These filings list the full count reported to state authorities.
What was taken and who is affected
The company’s notices explain that the records exposed vary by person, but may include names, postal addresses, dates of birth, Social Security numbers, and in some cases non-U.S. national ID numbers. In short, the stolen files could contain information that makes victims vulnerable to identity theft.
MathWorks’ own statements and regulatory notices put the window of unauthorized access between April 17 and May 18, 2025. The company discovered the breach on May 18 and publicly linked the outage of several services to a ransomware incident in late May. MathWorks says forensic teams contained the threat and that investigators found no ongoing activity after May 18.
What is not yet known
MathWorks has not identified any named ransomware group in public statements, and so far there is no verified public evidence that the stolen data has been published or sold. The company continues to monitor the situation and has offered identity protection services for those notified.
What you can do
If you use MathWorks products, check your account notices and follow any enrollment instructions for identity protection. Monitor financial and credit accounts, set up fraud alerts if you see suspicious activity, and change passwords for affected services. If you receive unusual messages or requests for money or personal data, treat them with suspicion and report them to your bank or local authorities.
• Keep an eye on financial activity: Regularly review your bank and credit card statements to spot unauthorized transactions quickly.
• Consider credit monitoring or freezes: In countries where these services are available, they can help detect or prevent new accounts being opened in your name.
• Reset passwords immediately: Update the password for your MathWorks account and avoid using the same password across multiple platforms. A password manager can help create and store strong, unique passwords.
• Enable multi-factor authentication: Adding a second layer of verification makes it much harder for attackers to gain access, even if they have your login details.
• Stay alert for phishing attempts: Be cautious of unexpected emails, calls, or texts asking for sensitive information. Attackers may use stolen personal details to make their messages appear more convincing.