Hackers attempted to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A. after gaining unauthorized access to its environment on Brazil’s real-time payments system, Pix, according to a filing with the U.S. Securities and Exchange Commission. The incident date is listed as August 29, 2025, and Evertec said Sinqia halted Pix transactions and engaged outside cybersecurity forensics experts to investigate.
Evertec describes itself as a public financial technology company that serves as a major full-service transaction processor across Latin America, Puerto Rico and the Caribbean. Sinqia, which Evertec acquired in 2023, is a São Paulo-based public company providing financial software and IT services to banks and other financial institutions.
In the filing, Evertec said Sinqia identified unauthorized activity in its Pix environment, halted Pix transaction processing and engaged outside cybersecurity forensics experts to investigate. The incident underscores the ongoing risk to real-time payments systems as criminals seek to exploit credentialed access and operational gaps.
Pix, Brazil’s instant payments system launched in November 2020, enables 24/7 transfers and has become the dominant payments method in the country. The case illustrates the system’s vulnerability landscape, an issue frequently discussed in cybersecurity circles.
Local media outlets implicated HSBC in the incident, though a bank spokesman said that no customer funds or data were affected. The bank’s statement has been cited by multiple outlets as part of the ongoing coverage of the breach.
Evertec said part of the $130 million has already been recovered, though it did not disclose the recovery amount, and stated that recovery efforts are continuing. The company stressed that there is currently no indication that the impact extends beyond Sinqia’s Pix environment or that personal data was exposed.
Central Bank of Brazil has revoked Sinqia’s access to Pix, and the company is working toward a quick restoration by providing the authorities with the required details and assurances. Sinqia’s Pix environment serves the operations of 24 Brazilian financial institutions, according to Evertec.
In a regulatory note, Evertec warned that the financial and reputational impact of the incident, including any effect on internal controls, could be material, though the exact implications remain uncertain.