The Central Bank (BC) announced that the number of related cyber incidents reported to financial authorities has more than doubled since 2023, rising to 59 from 24 last year. According to the tax authorities, 53 cases were recorded in the first eight months of 2025 alone.
This data comes from the Financial Stability Report released this Wednesday (12/11).
According to the BC, recent incidents have shown that cyber risks can have an impact on financial institutions and payment institutions, including, for example, financial losses.
According to financial authorities, reasonable participants in the State Financial System (SFN) do not have adequate mechanisms in place to protect services provided via APIs and to deal with incidents such as the one that occurred recently.
“A low percentage of institutions have practices related to the development, operation, and security of IT solutions that use or provide services through APIs. One of the key concerns is the low percentage of institutions that conduct robust data validation, establish and test non-functional requirements, and monitor the performance and behavior of services used or provided through APIs,” the report states.
Please also read
-
federal district
The hacker attack that diverted R813 million from Pix started at a luxury hotel in DF
-
Brazil
Lula praises PF operation against Pix hackers: ‘serious work’
-
Brazil
PF operation against Pix hackers intercepts R$640 million
-
Mirel Pinheiro
PF dismantles hacker group that embezzled R$813 million from Pix
Recent incidents cited by B.C.
In early September, fintech Monbank reported that it had been the target of a hacker attack that led to the embezzlement of R$4.9 million. Additionally, Sinqia, the company responsible for connecting banks to the Pix system, said that around R$710 million was diverted into fraudulent transactions due to the hacker attack.
In July, the central bank reported that C&M Software, a company that provides technology services and connects financial institutions to B.C., was the target of an attack on its infrastructure. This is one of the largest attacks ever seen on the National Financial System (SFN).
The text states that the criminal group has advanced knowledge of SFN operations and recruits employees from financial institutions and payment institutions.
Additionally, the tax authorities report that the tactics, techniques, and procedures of the criminals carrying out the cyberattacks indicate that these groups have advanced knowledge of SFN operations, organizations, and processes, including knowledge of specific aspects of the system architecture of the attacked institutions and the activities carried out by reserve pilots of these institutions.
“The incident, which occurred at a company that provides technology services to financial institutions, has raised specific concerns (…) The incident has exposed weaknesses related to key controls of financial institutions, including the management of risks related to services provided through APIs, as well as services provided by third parties and access control practices,” the text states.
However, the bank said it continues to monitor and respond to related cyber incidents that may impact SFN’s normal functioning.
Number of related cyber incidents reported to BC
- 2018-7
- 2019 – 18
- 2020 – 27
- 2021-33
- 2022 – 20
- 2023-24
- 2024 -59
- Until August 2025 – 53
According to BC, inappropriate access to financial institution credentials and subsequent access to technology infrastructure can lead to cyber incidents. This makes investing in cyber hygiene measures such as vulnerability patching, access controls, and adhering to secure IT asset configuration standards essential.
“Given this situation, BC has implemented a series of measures to promote SFN’s cyber and operational resilience, initially focused on improving security requirements, PSTI certification and operation, and expanding devices to prevent fraud,” it informed the bank.
About The Author
