Published on · Brazil
Brazil: a password sold for $2,700 and hundreds of millions gone from the banks
In late June 2025 criminals used the access of C&M Software, the company that connects several Brazilian banks to the PIX instant payment system, to order fraudulent transfers. They did not find a hole in the software: an IT employee had sold his username and password for about $2,700.
In 30 seconds
- An IT employee at C&M Software sold his credentials for about $2,700.
- With that access criminals ordered transfers from the reserve accounts of several banks: hundreds of millions of reais.
- The lesson: nobody should be able to open new access on their own. Sensitive actions need two people.
- When
- Late June 2025
- Who
- C&M Software, connected to PIX, Brazil
- How they got in
- Credentials sold by an employee
- How much
- Over 540 million reais per police, 800 million per other sources
What happened
C&M Software is a Brazilian company that connects several financial institutions to PIX, the Central Bank of Brazil's instant payment system. In late June 2025 criminals used its access to get into some institutions' reserve accounts and order fraudulent transfers.
Sources do not agree on the figures. Police, quoted by the Associated Press, speak of more than 540 million reais taken from at least one institution, and probably more from others. Other sources speak of about 800 million reais, around $140 million.
How they got in
Here the way in is known. According to police and the Brazilian press, an IT employee at C&M was approached in a bar and sold his username and password for about $2,700, paid in two cash instalments.
Then, following the criminals' instructions, he created more accounts in the system and switched on remote access. He was arrested a few days later.
Why this matters for a small business too
No software was broken: the weak spot was one person with too much power on his own. He could hand over his access, create new users and open remote access, and nobody else had to approve.
In a small business the same happens with whoever holds every password: the outside technician, the partner who runs online banking, the website administrator.
What to check in your business today
- Sensitive actions, such as new users, remote access and large transfers, are approved by two people, not one.
- Remote access stays off when it is not needed, and every time it is switched on it is logged who and when.
- Turn on automatic alerts for unusual activity on your bank account and in your key software.
- Nobody has more permissions than they actually use: review the list every three months.