Markets
Por
Gabriel Shinohara
— Brasília

The Central Bank of Brazil (BC) recorded 76 cyber incidents deemed “relevant” in the financial system in 2025, a 29% increase over 2024. The data were obtained by Valor through Brazil’s Access to Information Law (LAI). The rise in cases is linked to the growing use of digital financial services in recent years, according to specialists. In addition, attacks recorded in 2025 exploited vulnerabilities at companies providing services to institutions within the financial system.

The second half of 2025 saw a further increase in reports to the Central Bank. In June, the first major attack on the system, which affected C&M Software, became public. The Central Bank also tightened security rules starting in early September, increasing institutions’ sensitivity in identifying cases.

A 2021 resolution by the National Monetary Council (CMN) requires incidents or service disruptions considered relevant and “constituting a crisis situation” to be reported to the Central Bank in a timely manner. Institutions themselves define the criteria that characterize a crisis. Incidents covered by the survey range from information technology failures, such as service outages affecting customers, to hacker attacks.

Until 2024, the most common type of incident involved technology failures. With the increase in cases, incidents classified as fraud—which include attacks—became the majority. Of the 76 incidents last year, 39 were fraud and 27 were IT failures. In 2024, only nine cases were classified as fraud.

In a statement, the Central Bank said reporting relevant incidents is the responsibility of financial institutions, “without excluding the proactive identification of relevant incidents by the Central Bank as a result of its monitoring and supervisory processes.”

Denis Nakazawa, partner for financial services and digital at Oliver Wyman, said cyber risk is likely to continue rising. He cited ongoing digitalization and additional pressures, such as the use of artificial intelligence tools in attacks.

“Whether this turns into incidents or attacks will depend on how much institutions invest in security, and how much the government and regulators invest in security and new regulations. Risk has only increased in recent years,” Nakazawa said.

Two prominent cases in 2025 involved attacks on Sinqia and C&M Software. Both are Information Technology Service Providers (PSTIs), entities that connect institutions to systems managed by the Central Bank. The attacks diverted amounts that may have exceeded R$1 billion, although part was recovered. In Sinqia’s case, about 90% of the funds were recovered.

In the regulator’s view, last year’s incidents revealed weaknesses in financial institutions’ controls over risk management related to third-party services. Based on that assessment, the Central Bank strengthened requirements for PSTIs, including minimum capital levels and governance and internal control standards.

The latest Financial Stability Report (REF), published by the Central Bank, noted increasing “sophistication” in criminal actions. Citing “recent events,” the report said these incidents “required advanced knowledge” of the financial system’s operations.

The Central Bank’s director of supervision, Ailton de Aquino, said in November that cyber risk keeps him and other board members awake at night. During a press conference on the REF, he stressed that the Central Bank’s own structures are resilient, while recalling concerns about outsourced service providers of regulated institutions. “Third-party services concern not only the Brazilian banking supervisor, but also the American, French, German supervisors. This is a daily topic in our international forums,” he said.

Renata Teruya, cyber director at Marsh Risk, said Brazil is “light-years” ahead in banking digitalization compared with other countries and, for that reason, is a prime target for cyberattacks. Within the financial system, she noted, large banks have advanced cyber maturity, while the greater concern lies with smaller institutions. “These small banks and fintechs still need to build significant maturity. Criminals identified those vulnerabilities and began attacking them.”

Part of the discussion involves Application Programming Interfaces (APIs), one of the weak points highlighted by the Central Bank. APIs allow regulated institutions to connect with other services, such as those provided by non-financial companies, including links between banks and cloud service providers.

Cyberattacks against financial system

Year Cyberattacks
2018 7
2019 18
2020 27
2021 33
2022 20
2023 24
2024 59
2025 76

In the REF, the Central Bank said services provided via APIs are increasingly widespread in the financial system and have enabled agility and new business models. On the other hand, “this ease has also been exploited by criminals to automate fraudulent actions,” the document states.

The Central Bank is expected to conduct an assessment of supervised institutions’ IT controls between late March and early April, Valor has learned. The aim is to identify possible gaps and decide which regulatory topics should be prioritized. In November’s REF press conference, Mr. Aquino said “strong regulation” was needed for API usage and third-party services.

Among regulatory changes already implemented, the Central Bank introduced capital requirements for PSTIs and added controls for payment institutions. It also regulated markets such as Banking as a Service (BaaS) and cryptoassets. New cybersecurity rules will take effect on March 1. Institutions will be required to conduct annual penetration tests and adopt additional minimum standards, including for digital certificates, access controls and operational traceability.

Felipe Carteiro, partner in the digital practice at Rayes e Fagundes Advogados Associados, said the market is now in an adaptation phase following the regulatory changes. He noted there may be a “domino effect” of increased security requirements. “Supervised entities will want the entire group of companies providing services to deliver the same level of security and efficiency that the Central Bank requires of them,” he said.

C&M Software said it has “fully” implemented the regulatory updates defined by the Central Bank within the required deadlines. According to the company, the 2025 attack was analyzed and evidence indicated malicious action by a third party involving social engineering and improper use of client credentials. Sinqia, owned by Evertec, did not respond to requests for comment.

This article was translated from Valor Econômico using an artificial intelligence tool under the supervision of the Valor International editorial team to ensure accuracy, clarity, and adherence to our editorial standards. Read our Editorial Principles.

Mais recente Próxima Federal District pension faces R$1.5bn shortfall
More from Valor International

Agribusiness

Company will also offer hedge operations and pre-harvest financing

Patria-backed Tria enters sugar trading business

Politics

Estimated cost is R$11bn, with R$10 billion to come from the Brazilian Development Bank

Agribusiness

Measure aimed at lowering prices was expected to be signed Monday, but was delayed, Wall Street Journal reports

Politics

Alexandre Padilha says Anvisa acted to protect public health amid social media backlash

Health minister defends regulator after cleaning product recall

Business

First quarter ended with strong sales growth, indicating market preparation for price increases

Retailers stock up to avoid price hikes as war raises costs

Business

Sales revenue totaled R$123.7bn in the quarter, an increase of 0.4%

Petrobras reports Q1 profit of R$32.6bn, up 7.2% YoY

Politics

Former lawmaker accused of pressuring Supreme Court through U.S. sanctions

Brazil prosecutors seek conviction of Eduardo Bolsonaro

Economy

Executives say they see progress in ties between the two countries

Markets

Brazilian asset manager, with shares traded on the Nasdaq, also reported relatively strong growth in assets under management

Vinci Compass aided by Verde with profit driven by record fees

Business

Brazilian card network backed by major banks could seek a $3bn valuation in listing planned for September, sources say

Payment card brand Elo revives plans for U.S. IPO