Brazilian authorities have arrested a 48-year-old programmer in connection with a massive cyberattack that targeted Brazilian software firm C&M and led to the theft of R$1 billion (approximately $185 million) from six major banks.
João Nazareno Roque, a junior back-end developer at C&M, was allegedly recruited by hackers in a bar in São Paulo, local media reported. According to police, Roque sold his work credentials for R$5,000 (about $900) and later received an additional R$10,000 ($1,800) to execute malicious commands on C&M’s internal systems.
The hackers exploited the access to siphon millions from multiple financial institutions, triggering a major disruption in Brazil's financial sector last week.
Roque, who has 20 years of experience as an electrician and former cable TV technician, transitioned into tech after earning a degree in 2023. His LinkedIn profile listed his recent role as a back-end developer responsible for maintaining system infrastructure at C&M.
After compromising the company’s system, hackers carried out massive fake PIX operations. The attack took place in a single night and did not impact clients, only financial institutions contracted with C&M.
In his statement to the Cybercrimes police unit, Roque claimed he did not know the hackers personally and communicated with them only by phone. He admitted to changing his mobile device every 15 days to avoid detection.