C&M Software employee was arrested in the West Zone of São Paulo and had R $ 270 million blocked in his account
The Civil Police arrested on Thursday (3.Jul.2025) an employee of C&M software suspected of involvement in cyber attack that diverted R $ 1 billion from 8 Brazilian financial institutions.
The suspect was located in the west of São Paulo and identified as João Nazareno Roque. According to police, Roque gave access to computers used in the scheme. He had $ 270 million blocked in his account.
The cyber attack of the dawn on Monday (30.jun.2025) has reached the systems of C&M Software, a company that processes transactions between banks and the BC (Central Bank of Brazil). The company is responsible for the integration of financial institutions with the Pix system. The BC was informed of the problem on Tuesday (1.Jul.2025) and the PF (Federal Police) opened an inquiry on Wednesday (2.Jul.2025).
The invasion was possible by the privileged access that C&M has to national financial systems. According to the company, “To date, the evidence points out that the incident has stemmed from the use of social engineering techniques for improper sharing of access credentials, not failures in systems or technology.”
The BC (Central Bank), which had suspended the performance of C&M, conditioned its partial release to “express consent of the PIX participating institutionAnd to “robustness of transactional fraud and boundaries monitoring.”The decision was made“after the company adopts measures to mitigate the possibility of new incidents“.
The criminal action did not directly reach the PIX infrastructure, which continues to operate normally. Investigations continue to locate the others involved and recover the amounts diverted.
“From the first moment, all appropriate technical and legal measures were adopted, maintaining the company’s systems under strict monitoring and security control“, Said C&M in a statement. The company’s service, off on the 3rd (1.Jul.2025) after the attack, was partially restored on Thursday (3.Jul.2025).
The company also reported that, “With respect to the work of the authorities and the necessary confidentiality for investigations, it will maintain discretion and will not speak publicly as long as the procedures are underway.”
The suspect arrested, police said, is collaborating with the investigations. Until the publication of this text, the Poder360 He had not been able to locate his lawyer.
