Neobanks, FinTech and PSPs, July 2026

Active threats and campaigns

Ransomware and extortion, one mention with impact that could not be determined

This month’s material contained a single case centered primarily on ransomware or extortion, and the impact classification could not be determined with precision. DeXpose’s piece on Section9 at a Brazilian fintech is the best fit for that category, but the source itself presents the information as the threat actor’s claim. There is no confirmation in the material of asset encryption, validated data exfiltration, or verified negotiation with the victim.

That ambiguity matters. In the payments sector, many malicious actors use ransomware language to create urgency, but the operational outcome is not always the same. It may be only a mention on a leak site, extortion without encryption, or a deeper intrusion. When the evidence is not enough to distinguish among those scenarios, the report should preserve that uncertainty, because the risk facing the organization and the immediate countermeasures are not identical in each case.

The practical reading is that the ecosystem remains attractive to actors seeking reputational pressure against financial companies that depend heavily on public trust. In a fintech, a single credible allegation of exposure can affect onboarding, partnerships and perceptions of operational solvency, even without fully proven technical damage.

Fraud and phishing

There were no documented fraud or phishing cases reported as incidents during the period within the July-dated corpus. That does not mean there was no activity in the region, only that the material for this month did not typify any such incidents. The closest reference comes from Peru’s SBS, in an undated event, warning of rising complaints about digital fraud tied to identity theft and unauthorized banking transactions, with phishing and phone calls used to obtain personal and financial data.

The absence of a formal category in the indicators should not lead to a complacent reading. On the contrary, Peru’s regulatory environment and the pressure on payment channels suggest that identity fraud remains a structural threat, especially when it combines with service disruptions or incidents that push users toward less secure alternative channels. For fintechs and PSPs, operational friction often enables social-engineering fraud.

APT, opportunistic intrusion and pressure on exposed software

The month did not provide enough evidence to attribute classic APT campaigns in the vertical. What it did show was a sustained chain of opportunistic exploitation against critical and actively exploited vulnerabilities. That pattern, while less flashy than a sophisticated intrusion, is the one that can do the most damage in payments environments when affected systems are administration portals, back-office components or middleware with access to financial information.

Oracle E-Business Suite appeared several times in the material, with particular attention to CVE-2026-46817, a critical flaw in Oracle Payments File Transmission described as exploitable without authentication and through HTTP access. There were also references to Fortinet FortiOS, FortiSandbox, SonicWall SMA1000 and SharePoint. The presence of these names does not mean they were all used against Latin American entities, but it does show that the software ecosystem underpinning critical business operations came under heavy pressure during the period.

For a fintech or PSP CISO, the message is not abstract. The most dangerous campaigns in July were not necessarily the loudest ones, but the ones that exploited the gap between patch release and real-world deployment. In a payments chain, that delay can reach branches, back office, reconciliation dashboards, links to sponsor banks and poorly segmented test environments.

Critical vulnerabilities

The material reviewed identified 15 critical CVEs mentioned. The table below summarizes those explicitly linked to active exploitation or to technical descriptions relevant to this vertical.

The operational priority here should not be limited to cataloging each CVE, but to mapping where dependencies on those products exist. In this vertical, Oracle EBS may coexist with reconciliation, billing or order management; SharePoint can host sensitive internal portals; Fortinet and SonicWall usually appear at the perimeter and in remote access; Adobe ColdFusion and Joomla builders can support customer-facing applications or legacy integrations. The risk changes based on where the asset sits, but the pattern is the same: active exploitation and short remediation windows.

Regulation and Compliance

Brazil and access to Pix

O Globo's report on the possible restriction of access to Pix for banks and fintechs with weak cybersecurity is one of the month’s most important regulatory signals for the sector. The significance of the move lies in its logic: access to the payments rail would not be treated as an operational right, but as a capability conditioned on showing reasonable controls. That changes the market tone, because it shifts part of cybersecurity risk from the technical team to the core of the business.

For participants in the ecosystem, this means strengthening maturity testing, monitoring evidence, vulnerability management, and incident response capabilities. It could also speed up third-party audits and tighten contractual requirements among sponsoring banks, fintechs, PSPs and processors. If the regulator starts comparing risk profiles, control documentation stops being a formality and becomes part of business continuity.

Peru and incident notification

Peru was the clearest market on notification deadlines. Coverage from Infobae Perú, Brújula Digital and iupana agrees that financial institutions must inform users and, in some cases, the public, within very tight time windows. The 24-hour rule for reporting events that affect users, including cybersecurity incidents, forces faster initial triage, legal validation and coordination with customer support.

The impact on banks, fintechs and PSPs is significant. A notification that is poorly written, late or inconsistent can worsen reputational damage, but a rushed and misclassified communication also creates regulatory exposure. The only sustainable way to comply is to have preapproved criteria for severity, scope, minimum messaging, approvers and the point of contact with the regulator.

Compliance effects on the operating model

These regulatory measures do not operate in a vacuum. In a month when the material also reflected intense pressure from actively exploited vulnerabilities, the obligation to report quickly becomes an amplifier of internal demands. If an entity cannot quickly determine whether a degraded service is the result of a technical failure, a cybersecurity incident or a vendor issue, the regulatory clock still starts running.

For the fintech ecosystem, that means compliance and security are no longer parallel tracks. The team monitoring the stack, the team managing vendors, the team defining external communications and the team speaking with the regulator need a shared narrative from the first moment of the incident. July made that lesson clear.

Countries and most affected subsegments

Brazil

Brazil drew the clearest signal because of the mix of an operational incident, an attributed extortion threat, and a regulatory announcement about Pix. The Caixa lotteries case showed that an attack can disrupt collection and transaction services tied to the broader financial system, even when it is not described as a bank or a traditional fintech. That matters because Brazil's payments ecosystem is dense and depends on multiple actors sharing infrastructure, authentication, and integration channels.

At the same time, a possible restriction on Pix access for entities with weak cybersecurity introduces a new systemic risk criterion. For Brazilian fintechs, the potential requirement is not limited to patching faster. It also forces them to demonstrate governance, segmentation, identity management, remote access protection, and the ability to respond to third-party compromises without taking down the whole operation.

Section9's claim involving a Brazilian fintech reinforces the interest of malicious actors in the market. Even if unconfirmed, the existence of that claim suggests the country remains a high-value target for groups looking to monetize reputational pressure.

Peru

Peru was the country with the highest regulatory intensity. The combination of SBS Resolution 01741-2026, the 24-hour deadlines for reporting incidents, and the requirement to communicate outages or events to users in less than a day puts banks and fintechs under a higher standard of response. This is not only about cybersecurity in the narrow sense, but also operational discipline and communications capacity.

The digital financial services subsegment should read this as a forced maturity shift. An entity without incident traceability, a dependency inventory, and response playbooks loses time at the most expensive moment. For a PSP, the risk also extends to merchants and end users who feel the impact of channel outages or the need to invalidate transactions.

The SBS warning about digital fraud, although without a confirmed date, completes the picture. It suggests that identity spoofing and unauthorized transactions remain active threats. Combined with stricter notification obligations, the result is a market where incident handling can no longer be improvised.

Payments, acquiring, and gateways subsegment

Payment processors and gateways were indirectly affected in July through the claim involving a major credentialing firm in Brazil, the discussion of Oracle Payments File Transmission, and the nature of the systems affected in the Caixa case itself. This subsegment concentrates high-impact functions, because authorization, routing, and settlement decisions depend on internal components and third parties that do not always receive the same public exposure as a bank or a consumer app.

The risk logic for this group is especially sensitive to enterprise software vulnerabilities. A flaw in an administrative system, a support portal, or an integration platform may not look like an attack on the payments core, but it can provide entry to credentials, configuration, or transaction data. In July, that was one of the most consistent patterns in the material.

Consumer fintech subsegment

For consumer fintechs, the mix of regulation, fraud pressure, and exposure to public complaints creates a demanding environment. Although the period did not record fraud or phishing as a documented category in the dated facts, the SBS warning in Peru makes clear that identity spoofing remains a relevant abuse path. In addition, the fact that the month was dominated by vulnerabilities indicates that product security can no longer be limited to the mobile app or onboarding, but must cover the full chain of services and vendors.

Trends and signals to watch

There is no month-over-month baseline, because this is the first archived period with this indicator format for Latin America. For that reason, it would be wrong to invent a quantitative change versus June. The signal that can be read is internal to the month itself: a dominance of vulnerabilities, few unclassified incidents, one case centered on ransomware or extortion, and three regulatory moves. That profile suggests the technical attack surface remained more active than confirmed intrusion activity.

The first trend to watch is whether Peru's regulatory pressure turns into more public incident disclosure during August and September. If entities begin reporting quickly and consistently, the market will gain real visibility into the frequency of outages, attacks and third-party failures. If, instead, formal compliance lags, the first weeks could show legal noise without enough technical detail.

The second signal is Brazil. If the discussion around Pix moves from intent to an operational standard, the country could become a regional reference for how to tie access to critical rails to cybersecurity maturity. That could push banks and fintechs to speed up remediation, inventory and vendor governance programs. It could also open a tougher phase of third-party auditing for providers that are now plugged into payments without uniform controls.

The third signal is the persistence of active exploitation in widely used software. Oracle EBS, Fortinet, SonicWall, ColdFusion and SharePoint are not exotic names for security teams. They are broadly deployed platforms, often in areas not seen as part of the core payments stack. As long as that mismatch persists, the risk is that the first sign of compromise will show up in a support portal, an admin console or an integration component, not in the visible transaction layer.

The fourth signal is the gray market for actor claims. The two unconfirmed events involving Section9 and 1877 Team show that leak sites and manifestos continue to work as pressure tools, even when independent validation is weak or nonexistent. For a CISO, that means separating noise from evidence, but also recognizing that a public claim alone can trigger brand issues, customer support pressure and negotiations with partners.

Security team recommendations

First, review the real exposure to the products that dominated the month’s vulnerability agenda. It is not enough to know whether Oracle, Fortinet, SonicWall, SharePoint or Adobe are in the inventory. Teams need to know where they are, what privileges they have, what credentials they use, what interconnections they maintain, and what depends on them. In payments, a back-office application can be as critical as a production endpoint.

Second, speed up asset classification based on impact to payment continuity. If a system touches reconciliation, authorization, account provisioning, onboarding or dispute handling, its criticality should not be hidden in a generic matrix. Teams should have lists of essential services with owner, RTO, RPO and isolation criteria already defined. July showed that outages that look peripheral can end up affecting transactions and trust.

Third, rehearse the regulatory process before an incident happens. In Peru, the 24-hour windows require a coordinated response across security, legal, operations and customer service. That means communication templates, notification thresholds and a fast way to determine whether the event affects users or only internal infrastructure. In Brazil, if the logic of conditioning Pix moves forward, evidence of controls and remediation also needs to be ready for audit.

Fourth, strengthen third-party management and access segmentation. This month’s material suggests the payments value chain still has plenty of points where a technical failure or exposed credential can escalate. Remote access, administrative consoles, support providers and integration applications should all be under continuous review, with strong MFA, anomalous activity monitoring and privilege segregation.

Fifth, treat claims on leak sites as early signals, not as settled facts. They should not be ignored, but they also should not be turned into automatic confirmations. The useful process is rapid internal triage, evidence preservation, scope verification and controlled communication. In the financial vertical, overreaction can cause self-inflicted damage, but delay can too.

Sixth, prioritize remediation of actively exploited vulnerabilities over generic severity lists. July made clear that the value of an indicator is not only in CVSS, but in ongoing exploitation and how close the software sits to the business. A critical CVE in an administration platform with access to payments is more urgent in practice than a theoretical finding in an isolated system.

Material limitations

This report was built exclusively from the material provided for July 2026 and from the sources listed as available for citation. No internet was used and no external evidence was added. The indicator window is the one stated above, 66 dated facts in July 2026, plus 1 undated fact that was left out of the counts.

A zero value in an indicator, especially the one for documented fraud or phishing cases, means no fact classified that way appeared in the material analyzed this month. It does not mean there was no fraud, phishing, or identity abuse in the region. Likewise, the number of critical CVEs mentioned reflects only what was recorded in the provided corpus and does not rule out the existence of other vulnerabilities exploited in Latin America during the period.

Facts should also not be confused with telemetry. The material does not include aggregated figures for attempts, blocks, or scans, so this report does not use that type of data as a substitute for incidents. Mentions of CISA KEV, weekly vendor summaries, or technical reports were treated as signals of vulnerability and active exploitation, not as measured regional intrusion volume from sensors.

Sector coverage also has limits. Although the focus of this report is neobanks, FinTech, and payment processors, some facts affect the broader financial ecosystem, such as the Caixa case or the summaries on Oracle EBS and SharePoint. When interpreted, they should be read as value-chain risks for the vertical, not as evidence that all victims belong directly to a neobank or a PSP.

Finally, facts without a confirmed date were excluded from the indicators, even though some provide useful qualitative context, such as the Peruvian SBS warning about digital fraud. Also excluded from this report were sources not listed for citation, as well as consumer social media, sponsored content, and similar materials, which were not used to support analytical claims.

Graphics