Brazilian police have arrested a suspect in connection with a breach that siphoned more than 540 million reais (about $100 million) from the banking system , authorities announced on Friday.
See also: Louis Vuitton Korea: Customer data breach
The breach affected PIX, Brazil’s popular instant payment system, which is used by 76.4% of the population. The hackers targeted software company C&M, which connects financial institutions with the Central Bank to execute transactions via PIX.
Police in Sao Paulo said the $100 million in losses involved just one financial institution that worked with C&M and that the total damages could be even greater.
Authorities identified the suspect as João Roque, a C&M IT employee who allegedly helped others gain unauthorized access to the PIX system.
See also: South Korea: SK Telecom fined for data breach
According to the police, Roque told investigators that he sold his credentials to hackers who approached him earlier in the year. The Associated Press was unable to contact his lawyers directly.
After breaching the company's system, hackers made massive fraudulent transactions through PIX. The fraud took place overnight and did not affect customers — only financial institutions that had contracts with C&M.
Police are now trying to identify other members of the group and said at least four other people were involved in the bank breach. They are also tracking suspicious assets and trying to freeze them. So far, authorities have frozen 270 million reais linked to the ring.
See also: Kelly Benefits: Data breach affects 550,000 people
Brazil's Central Bank said on Thursday it had suspended some of C&M's operations after the company took steps to reduce the risk of further attacks. C&M said in a statement published by local media that it was fully cooperating with authorities and that initial evidence indicated the breach was caused by unauthorized access to security credentials through social engineering techniques and not by flaws in its systems.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
