Sinqia (Evertec) hack — August 2025

On 29 August 2025 Sinqia S.A., the Brazilian subsidiary of the Puerto Rico-based payments company Evertec, detected unauthorised activity in the environment it operates for Pix, the Brazilian central bank's instant payment system. In an 8-K filed with the U.S. Securities and Exchange Commission, Evertec said approximately R$710 million in unauthorised transactions affecting two of Sinqia's financial-institution customers were processed through that environment on the day, and that preliminary forensics indicated the transactions were introduced by exploiting the credentials of legitimate Sinqia IT vendors. Sinqia halted processing and cut off those credentials. The central bank then barred it from resuming in the national payments system until it reviewed the remediation, forcing Sinqia's clients onto other providers.

Evertec did not break the figure down or state how much was lost, saying only that a portion had been recovered and that recovery efforts continued. G1, citing sources at the affected institutions, reported that HSBC accounted for about R$670 million and the fintech Artta about R$41 million, and that the Banco Central do Brasil blocked roughly R$589 million, about 83 per cent of the diverted total. At the late-August 2025 exchange rate, R$710 million was about $130 million and R$589 million about $108 million.

HSBC said no customer accounts or funds were affected because the transactions occurred only in the provider's system, and Artta said the accounts involved are held at the central bank purely for interbank settlement.

In March 2026 the Federal Police and São Paulo prosecutors ran 'Operação Cofre Digital', making arrests and freezing assets. Investigators said suspects used shell companies to convert the diverted money into cryptocurrency. No one has been convicted.