INCIDENT REPORT · CP-2025-010

C&M Software breach and Pix reserve-account theft

L3 · ELEVATEDCONFIRMED

Criminals abused access at C&M Software, a provider connecting smaller Brazilian banks and fintechs to central bank payment systems including Pix, to divert funds from institutions' reserve accounts.

Incident ID: CP-2025-010
Disclosure date: 02 JUL 2025
Detection date: Not publicly documented
Affected countries: Brazil
Plotted location: Sao Paulo, Brazil (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Theft via a payments-infrastructure provider with temporary disruption to national instant-payment access.
Attack type: Supply-Chain Attack
Nature: Malicious activity
Attack vector: An employee of C&M Software sold his credentials to criminals, who used the firm's connection to central bank systems to make unauthorized transfers
Sectors: Finance, Technology
Critical infrastructure: Yes
Organizations affected: C&M Software, Several Brazilian financial institutions connected via C&M
Operational consequences: Brazil's central bank ordered C&M disconnected on 2 July 2025, temporarily disrupting Pix for several institutions; reported losses ranged from over R$540 million to about R$1 billion, and authorities blocked R$270 million. São Paulo police arrested the employee.
Estimated financial impact: Loss estimates vary across media reports (about $100-180 million); no single official figure confirmed.
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

C&M Software breach and Pix reserve-account theft

L3 · ELEVATEDCONFIRMED

Criminals abused access at C&M Software, a provider connecting smaller Brazilian banks and fintechs to central bank payment systems including Pix, to divert funds from institutions' reserve accounts.

Incident ID

CP-2025-010

Disclosure date

02 JUL 2025

Detection date

Not publicly documented

Affected countries

Brazil

Plotted location

Sao Paulo, Brazil (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Theft via a payments-infrastructure provider with temporary disruption to national instant-payment access.

Attack type

Supply-Chain Attack

Nature

Malicious activity

Attack vector

An employee of C&M Software sold his credentials to criminals, who used the firm's connection to central bank systems to make unauthorized transfers

Sectors

Finance, Technology

Critical infrastructure

Yes

Organizations affected

C&M Software, Several Brazilian financial institutions connected via C&M

Operational consequences

Brazil's central bank ordered C&M disconnected on 2 July 2025, temporarily disrupting Pix for several institutions; reported losses ranged from over R$540 million to about R$1 billion, and authorities blocked R$270 million. São Paulo police arrested the employee.

Estimated financial impact

Loss estimates vary across media reports (about $100-180 million); no single official figure confirmed.

Attribution (as stated)

No official attribution recorded