A Brazilian IT worker helped a cybercrime gang pull off one of the biggest financial heists using the PIX system. Losses are skyrocketing.
Rejoignez-nous sur les réseaux sociaux
Aucun spam – Désinscription en un clic – Vie privée respectée
João Roque, an employee at C&M, has been arrested by Brazilian police. He is suspected of handing over his credentials to a hacker network, triggering a targeted attack on PIX, the payment system used by more than three-quarters of Brazil’s population. Losses already exceed 540 million reais (about €100 million), mainly hitting banks tied to C&M’s infrastructure. While individual accounts were not compromised, the Central Bank suspended some operations and froze the company’s activity. The unprecedented scale of the case highlights how human weak links inside the financial digital ecosystem can undermine even the most robust systems.
PIX, a vulnerable system breached from the inside
In a quiet office, the breach began. João Roque, an employee at Brazilian firm C&M, is accused of handing over his credentials to an organized crime group. A classic insider compromise with devastating consequences. With this access, attackers manipulated PIX — Brazil’s widely used instant payment platform — by simulating massive overnight transactions.
C&M’s infrastructure, specialized in relaying information between banks and the Central Bank, was a critical node. Once hijacked, the entire system was exposed. The attack did not target individual accounts but interbank flows, enabling large-scale fraudulent transfers in near-total secrecy.
This was not about technical sophistication. Social engineering combined with insider knowledge made the difference. A lightning-fast operation, invisible to users, drained hundreds of millions of reais from financial circuits in just hours.
540 Million Reais gone, one bank exposed
Early findings from São Paulo police show losses already hitting 540 million reais (about €100 million), concentrated in a single financial institution. That figure may rise as more suspicious transfers are reviewed.
PIX, valued for its speed, has no native cancellation features. That makes such attacks efficient: once launched, funds instantly exit the legal system. Hackers exploited this design to flood the network with illicit transfers before vanishing with the money.
In response, the Central Bank froze C&M’s operations across critical segments, forcing partial service shutdowns. About 270 million reais were seized or frozen, showing some flows were traced in time. Yet the core of the criminal network remains active, with at least four suspects still at large.
The arrest of João Roque is just the first piece. Investigators now aim to map the chain of responsibility: how was an active employee approached, recruited, and manipulated without tripping internal alarms? C&M insists the breach was not a technical flaw but human error. But trust in insiders is itself a vulnerability.
In interconnected banking systems, security goes beyond firewalls and audits. It demands behavioral vetting, privilege oversight, and proactive monitoring of legitimate access. Social engineering has become the most profitable and hardest-to-detect weapon.
C&M now cooperates with authorities and claims to have implemented extra safeguards. The Central Bank is tightening oversight of PIX’s connectivity providers. But for financial institutions already hit, one question lingers: how to rebuild trust in a digital mesh so dependent on human links?
The €100 million PIX heist is not just bank fraud. It exposes systemic fragility, where a single set of credentials can open the gates of finance. Here, technology did not fail. Humans did.
How many other operators inside critical providers may already be compromised without anyone noticing?
Rejoignez-nous sur les réseaux sociaux
Aucun spam – Désinscription en un clic – Vie privée respectée
