C&M Software Cyber Breach Results in $140 Million Theft

On June 30, 2025, a significant cybersecurity breach occurred at C&M Software, a service provider for the Brazilian Central Bank. The breach resulted in the theft of approximately $140 million, highlighting vulnerabilities in financial infrastructure and the risks posed by inadequate internal controls within financial service providers.

The attack was facilitated by an employee who sold his login credentials to threat actors for around $2,780. This social engineering attack allowed hackers to gain unauthorized access to the reserve accounts of six financial institutions connected to the central bank. The stolen funds were then laundered through cryptocurrencies, with conversions carried out through Latin American over-the-counter (OTC) platforms and crypto exchanges. Blockchain investigator ZachXBT revealed that between $30 million and $40 million of the stolen funds were converted into crypto assets such as Bitcoin, Ethereum, and Tether.

C&M Software confirmed that the breach began with a social engineering attack, where an employee was approached outside the company premises by a third party who promised financial benefits in exchange for login credentials. The firm emphasized that the incident stemmed from the misuse of internal credentials and not from any external technical breach. C&M Software also stated that its infrastructure remained uncompromised and that its internal controls played a vital role in quickly containing the threat and supporting the ongoing investigation.

Immediate law enforcement actions included freezing assets and issuing disconnection orders to firms using the affected software. Approximately $49.8 million has been frozen so far. While the Brazilian Central Bank confirmed the security of critical systems, there is limited public comment from either C&M Software or the central bank regarding further action or policy changes following the incident.

Security experts have pointed out that this breach underscores the increasing risk of social engineering attacks, where perpetrators manipulate employees to gain access to critical systems and data. These types of attacks, which include phishing, impersonation, and fake support channels, are on the rise globally. The incident serves as a reminder that the weakest link in cybersecurity is often human error or manipulation.

The theft has been described as the largest digital heist in Brazil's history, highlighting the need for enhanced security measures and employee training to prevent similar incidents in the future. The Brazilian Central Bank is currently probing the crypto laundering aspect of the breach, emphasizing the importance of vigilance and robust cybersecurity protocols in the financial sector.