Inside Job: $100 Million PIX Heist Rocked by One Password

A password, one night: In Brazil, a gigantic bank fraud was uncovered, in which over $ 100 million was moved via the real-time payment system PIX. The central access came from the inside – sold by an IT employee.

IT employee sells login: 100 million bank robbery

What could sound like a high-tech hack began with a simple broken trust. In a country that relies heavily on digital payments, a single login was sufficient to access accounts in the central bank system. The attack was not aimed at technology, but on the human weak point – and it hit a system that was considered safe for millions.

PIX is the undeniable backbone of Brazilian payment transactions: Over 76 percent of the population use the state system for real -time transfers – without fees, around the clock. This is made possible by technical service providers that connect smaller banks to the central bank. This is exactly where the attack started.

The police in São Paulo said on Friday (via Techxplorer) a technician of the payment service provider C&M. According to investigators, he sold his personal access data to a hacker group that had specifically recruited him. With the help of these accesses, the perpetrators carried out a variety of unauthorized transactions in just one night – directly via the PIX network, but only at the expense of banks, not the end customers. “The attack was carried out by authorized registration data that was illegally acquired,” said a statement by C&M compared to local media.

The company emphasizes that no technical security gaps were used – the error was in the human factor: social engineering. The hundreds of false transfers with a single compromised login of false transfers could of course still raise questions.

Damage not foreseeable

The Brazilian central bank reacted with the preliminary blocking of parts of the C&M infrastructure. Investigators assume that at least four other people were involved in the coup. Assets of around 270 million Real were already frozen – that corresponds to around 42.5 million euros. A affected bank alone reports losses of around 100 million euros.

The total damage could be significantly higher. The fact that a single compromised access is sufficient to postpone hundreds of millions in a few hours shows a structural weakness: even highly available and state -controlled payment systems remain vulnerable – if they rely on central interfaces and familiar employees.