Business Context and Reporting Period
This Form 8-K was filed by EVERTEC, Inc. on August 29, 2025, reporting a cybersecurity incident involving Sinqia S.A., a Brazilian subsidiary. The incident occurred on August 29, 2025, within the Brazilian Central Bank's (BCB) real-time payment system known as Pix.
Key Financial Metrics
The filing does not provide standard financial metrics such as revenue, profit, cash flow, margins, debt, or liquidity. The only specific financial figure disclosed relates to the incident:
- Unauthorized Transactions: Approximately R$710 million in Business-to-Business transactions were processed through the compromised environment.
- Recovery Status: A portion of the amount has been recovered, with additional efforts ongoing.
Material Changes and Incident Details
The primary material event is the unauthorized activity in Sinqia's Pix environment. Key details include:
- Scope: The incident is limited to a single application in Brazil affecting two financial institution customers out of 24 total Pix customers. No other Evertec products, services, or systems are impacted.
- Root Cause: Preliminary forensics indicate the exploitation of legitimate IT vendor credentials, which have since been terminated.
- Operational Impact: Sinqia halted transaction processing. The BCB has suspended Sinqia's ability to resume processing in the Brazilian Payments System (SPB) and Pix pending review and approval.
- Data Security: The Company has no indication that personal data was compromised.
Outlook, Risks, and Contingencies
Management has not determined the full scope of liability, insurance coverage applicability, or potential claims against third parties. The financial and reputational impact, including effects on internal controls, is currently unknown but could be material. The Company is working to obtain BCB approval to resume operations. Forward-looking statements regarding the incident's resolution are subject to significant uncertainty.
Investor Verification Checklist
- Verify the final amount of unrecovered funds from the R$710 million in unauthorized transactions.
- Monitor the timeline for BCB approval to resume Pix and SPB transaction processing.
- Assess potential regulatory fines or penalties from Brazilian authorities.
- Review future filings for updates on litigation, insurance claims, or reputational damage.
- Confirm that no other systems or customer data were compromised beyond the initial assessment.