Brazil’s central bank revealed that C&M Software, a technology provider supporting small financial institutions, was hit by a cyberattack earlier this week. The attack targeted systems on Monday, prompting the central bank to order C&M to cut off access to the infrastructure it manages for these institutions.
C&M Software’s commercial director, Kamal Zogheib, confirmed that hackers used stolen client credentials to try to break into their systems. Fortunately, the company says its most important systems stayed secure and are still running smoothly. They have put all security measures in place and are working closely with the central bank and Sao Paulo police to investigate what happened.
The cyberattack also affected several financial institutions, including Brazilian bank BMP. BMP reported that hackers gained unauthorized access to their reserve accounts held at the central bank. These accounts are used only for interbank transactions, not customer accounts, so no clients were directly harmed. BMP stated that it has taken all the necessary steps to address the issue and that it has enough collateral to cover any impacted funds without disrupting its operations or partners.
Authorities say C&M Software serves about two dozen smaller financial institutions. While some amounts were involved in the attack, the losses did not reach billions of reais. According to sources familiar with the case, no clients suffered any financial losses.
The central bank specifically mentioned that the affected institutions lack their own connectivity infrastructure. These are mostly digital payment companies, which have become more common in Brazil thanks to innovations like Pix, the instant payment system launched by the central bank in late 2020. Pix has quickly become the country’s top payment method, driving competition and change in the financial sector.
This incident highlights the growing risks digital payment providers face as they expand. Still, the swift response from C&M, the central bank, and affected institutions helped contain the damage for now. Officials continue to investigate to ensure stronger protections in the future.