Incident · Senior
Attack on a connectivity provider (PSTI) and the hardening of Pix
An intermediary becomes a single point of compromise for several institutions. The central bank's measures become design requirements: a R$15 thousand cap and alerts and blocking of the PI Account.
Short answer
An intermediary becomes a single point of compromise for several institutions. The central bank's measures become design requirements: a R$15 thousand cap and alerts and blocking of the PI Account. Not every institution that offers accounts connects directly to the financial system's infrastructure.
01 · CONTEXT
The intermediary that connects those without their own connection
Not every institution that offers accounts connects directly to the financial system's infrastructure. In the Central Bank's statement, C&M Software appears as a technology service provider for institutions that provide transactional accounts without their own means of connection. The Pix management report, in turn, describes participants that connect to the financial system network through a technology service provider, the PSTI.
According to BMP's statement, C&M was responsible for the messaging that links financial institutions to the Brazilian Payment System, including the Pix settlement environment.
An institution without its own connection depends on the technology provider to reach the infrastructure.
The provider handles the messaging between the institutions and the payment system, including Pix settlement, according to BMP.
In the diagram, the two client institutions share the same path to the infrastructure.
02 · THE INCIDENT
What is known about the attack on C&M
The Poder360 article says the Federal Police and the Central Bank are investigating a hacker attack against C&M Software and places the crime on July 1, 2025. In a statement, the Central Bank said C&M reported an attack on its technology infrastructure.
In BMP's statement, the incident compromised C&M's infrastructure and allowed unauthorized access to reserve accounts of six financial institutions, BMP among them. BMP describes these accounts as held at the Central Bank and used for interbank settlement, unrelated to end customers' accounts.
The provider's infrastructure was compromised, according to BMP.
The compromise allowed unauthorized access to reserve accounts of six institutions, according to BMP.
According to BMP, these accounts serve interbank settlement and are unrelated to end customers' accounts.
The newspaper found that the systems run by the Central Bank were not affected.
The Central Bank ordered that the institutions' access to the infrastructures operated by the provider be shut off.
According to the article, the request to disconnect the company's financial clients was intended to isolate and contain the problem.
03 · THE CAP
Two Pix measures to limit damage
The Pix management report lists, among the MED improvements, two measures that matter to this case. The first is a cap: since September 2025, participants that are not authorized by the BC or that connect to the network through a PSTI have a limit of R$15,000.00 per Pix transaction, and the SPI automatically rejects anything above that. The limit is a rule on conformidade enforced in the SPI itself, the central system.
In the diagram, the participant reaches the SPI through the technology provider.
The SPI, operated by the BC, automatically rejects transactions above the R$15,000.00 limit for this type of participant.
| What it does | Where it acts | |
|---|---|---|
| Amount limit | Automatically rejects transactions above the cap | In the SPI, for participants without BC authorization or connected through a PSTI |
| PI Account monitoring | Reports risk situations and allows manual blocking | With the SPI's direct participants |
04 · THE PI ACCOUNT
Alert and blocking in the participant's hands
The second measure is one of monitoramento. In December 2025, the BC made account management and monitoring tools for the PI Account available to the SPI's direct participants. They send automatic notifications in risk situations, such as reaching the minimum balance or atypical transactions, and allow manual blocking and unblocking of the account. The report states that this helps participants act quickly and autonomously.
The BC offers the direct participant PI Account monitoring tools.
In risk situations, such as minimum balance or atypical transactions, the participant receives an automatic notification.
The participant can issue manual blocking and unblocking of the account.
05 · LESSONS
Design requirements for the connecting third party
Some ideas apply to any system that depends on an intermediary: limit the amount the third party's path can move, enforcing the limit in the central system and not at the third party; monitor the settlement account with alerts that lead to action; and be able to shut off a third party's access quickly, without taking the others down. All of this is part of compliance and third-party risk.
Frequently asked questions
What is Attack on a connectivity provider (PSTI) and the hardening of Pix?
An intermediary becomes a single point of compromise for several institutions. The central bank's measures become design requirements: a R$15 thousand cap and alerts and blocking of the PI Account.
What does the Attack on a connectivity provider (PSTI) and the hardening of Pix design cover?
It is organized in these sections: The intermediary that connects those without their own connection, What is known about the attack on C&M, Two Pix measures to limit damage, Alert and blocking in the participant's hands, and Design requirements for the connecting third party.
How long is Attack on a connectivity provider (PSTI) and the hardening of Pix and what level is it?
It takes about 14 minutes to read and is rated Senior level.
Now design it yourself
Run this case as an interview in the System Design school: you make the decisions, the tutor challenges them and you see how your design scores.