Brazil
BRA
Compromise of CM SOFTWARE enables massive PIX fund diversion in Brazil
On 30/06/2025, Brazilian provider CM SOFTWARE was compromised, enabling unauthorized access to reserve accounts of at least six institutions via the PIX infrastructure and diversion of funds estimated at BRL 800 million (~USD 148M). The Central Bank ordered the provider’s immediate disconnection, degrading services and disrupting operations for connected institutions.
88
Estimated severity
88 / 100
84
Source reliability
84 / 100
Approximate Date
30/06/2025
Targeted Company
CM SOFTWARE
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
Brazil
Affected countries
Brazil
Impacted regions
South America · Brazil
Operational Impact
Duration
No information
Financial impact (USD M)
$148M
Impact types
Operational disruptionService degradationDownstream customer disruptionSupply chain coordination disruption
Affected sectors
Finance & Insurance
Affected departments
Information Technology
Attack Profile
Attack types
Unauthorized access
Attributed threat actors
No information
Sources
Incident Sources
blog.lacnic.nethttps://blog.lacnic.net/ciberataque-sistema-financiero-brasilforbes.cohttps://forbes.co/2025/07/08/tecnologia/se-robaron-us148-millones-en-un-ciberataque-al-sistema-financiero-de-brasilblog.nivel4.comhttps://blog.nivel4.com/ciberataque/ciberataque-a-proveedor-tecnologico-impacta-al-sistema-financiero-brasileno