Financial Firms Are Facing Rising Threats. Is Your Business Ready?

The financial industry is one of the most targeted today when it comes to cyberattacks. Recent reports reveal that in Q3 2024, 45% of the detected 600,000 critical infrastructure attacks targeted financial institutions. Downtime can also cost them as much as $152 million.  

This isn’t just theoretical, however. In fact, threat actors recently almost stole a large amount of money from a financial technology firm within seconds — and it wasn’t difficult for them to do so.

The Sinqia Cyberattack, Explained

Cybercriminals recently attempted to steal $130 million from Brazilian financial technology firm Sinqia, a company owned by public fintech giant Evertec.

According to Evertec’s US Securities and Exchange Commission (SEC) filing, Sinqia detected unauthorized activity in Pix, its instant payments system. The hackers tried performing unauthorized business-to-business transactions involving two Sinqia customers, which were also financial institutions.

“Upon detecting the incident, and in accordance with its incident response protocol, Sinqia halted transaction processing in its Pix environment and began working with outside cybersecurity forensics experts,” the SEC filing reads.

Investigations showed that the cybercriminals gained access to Pix through stolen credentials from an IT vendor. According to Evertec, part of the stolen money has already been recovered, with efforts to retrieve the rest still ongoing as of this writing. No personal data was exposed.  

However, Evertec notes that the financial and reputational impact of the incident, including its impact on the firm’s internal controls, are still unknown but could be significant.

What Cybersecurity Lessons Can You Learn from This Incident?

While the Sinqia breach happened in Brazil, the attackers’ technique of using stolen vendor credentials is one we see in the United States and globally. As such, this case study offers various cybersecurity takeaways businesses, financial or otherwise, can learn from. These include:

1. Access Privileges are a Major Blind Spot

Sinqia’s attackers used stolen vendor credentials to access the Pix environment. This indicates that your access privileges can easily be exploited to infiltrate your systems. This is why implementing the following measures is a must:

• Principle of Least Privilege (PoLP): This ensures that each user has only access to the data and systems necessary for their job, and nothing more.

• Vendor Privileges Audit: Regularly review and evaluate third-party vendors’ access rights to your systems and data. This prevents overexposure of critical systems and silent lateral movement by threat actors.

• Enforce multifactor authentication (MFA): This requires users to provide two or more proofs of their identity, such as a one-time code, authenticator app, or access badges. This makes it difficult for cybercriminals to access an account even if they know the user’s password.

2. Real-Time Monitoring Is Not Enough

Sinqia had real-time monitoring and incident response protocols in place that detected the breach and halted the transactions. However, this wasn’t sufficient to quickly detect the threat actors’ suspicious behavior, since they used trusted credentials. In these situations, behavioral analytics solutions become essential. These include the following:

• Microsegmentation: This divides a network into small, isolated zones, making it difficult for an attacker to move laterally to another segment and steal data.

• User and Entity Behavior Analytics (UEBA): UEBA establishes a baseline of “normal” behavior for every user and entity. If an attacker using an employee or vendor’s credentials deviates from the baseline, the UEBA system marks this as suspicious and generates a high-priority alert.

• Continuous Monitoring: Businesses must constantly look for indicators of compromise and attack. This includes checking for actions like communication with known malicious IP addresses and unusual command-line activity.

3. Compliance Matters More Than You Think

As a result of the incident, the Central Bank of Brazil revoked Sinqia’s access to Pix, showing the rising regulatory pressure surrounding financial companies.  

This means your business’s compliance should never be just about ticking checkboxes and avoiding fines. It should be about understanding risk, building a resilient security initiative, and proving resilience during real-world attacks.

Some best practices you can apply to remain compliant with industry regulations include:

• Strong Backups: Maintain encrypted copies of critical systems and data and store them in segregated environments to prevent ransomware from rendering them inaccessible.

• Employee & Vendor Training: Educate your teams on malware and phishing risks, as well as secure remote access practices. Require periodic re-certification for access to sensitive systems.

• Incident Response Readiness: Ensure your Security Information and Event Management (SIEM) systems and forensic logging are in place and retained to support investigations.  

• Compliance Demonstration: Internal audits and third-party assessments can help you document and exhibit compliance with regulations.

How Techmedics Can Help Your Business Improve Your Security Posture

Any business, whether in the financial sector or not, is vulnerable to cyberattacks that can cause downtime, financial losses, and reputational damage. Thankfully, a reliable managed security services provider like Techmedics can help you reduce the risk of security incidents and limit their impact on your organization. Some of our core capabilities include:

• Advanced Endpoint Protection: Our Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) tools detect, analyze, and address threats before they impact your operations.

• Incident Response and Recovery: Our security systems promptly detect and contain threats. Once contained, our engineers assess the scope of the incident, identify the cause, and quickly restore affected data and systems.

• Network Security Management: We monitor network traffic, define strategies, and apply critical patches to manage risks and prevent unauthorized access into or between parts of your network.

• Security Policy Design and Enforcement: Keep your assets secured and ensure industry compliance by identifying potential threats within your infrastructure and crafting policies to address them.

What’s more, we provide effective cybersecurity services for your organization by providing personalized support and cost-effective plans. The best part? We employ local engineers in Dallas, Denver, Las Vegas, and Los Angeles, so you can benefit from onsite support and quick response times.

Your business deserves cybersecurity protection that gives you peace of mind. Talk to us today for a FREE MSSP consultation.

‍