Cyberattack Cripples Lottery Outlets, Caixa Caps Payments at R$2,000

On Tuesday, July 21, Brazil's state-run bank Caixa Econômica Federal identified a cyberattack that disrupted its lottery channel, forcing the institution to impose emergency limits on financial transactions. Since then, the maximum amount allowed for deposits and bill payments from other banks at lottery outlets has been capped at R$2,000. According to Convergência Digital, full service restoration has been postponed to Monday, July 27.

The measure directly affects millions of Brazilians who rely on lottery outlets as their primary — or only — point of access to the financial system. Without a bank account, this population uses the outlets to pay bills, make deposits, and handle small transactions. With the restriction, simple transactions exceeding R$2,000 — such as paying a rent bill or settling a credit card invoice — have become impossible at these locations.

The R$2,000-per-transaction limit applies to two specific service codes: bills from other banks (code 850100) and deposits (code 012081), as reported by Convergência Digital. The cap is active across the entire lottery channel at least through Saturday, July 25, with full normalization expected only on Monday, July 27. Caixa confirmed the cyber incident on Tuesday, July 21, but did not disclose the attack's cause or whether any data breach occurred.

For lottery outlet owners, losses are immediate and substantial. One industry entrepreneur told Convergência Digital that his unit recorded about R$500,000 in irregular transactions. Another, operating in São Paulo state, reported over R$300,000 in bills that went unpaid due to the restrictions. According to reports gathered by the publication, hundreds of outlets across multiple states have been affected.

Despite the disruptions, Caixa stated that neither customers nor lottery business owners will suffer financial losses. The bank did not detail, however, how it will compensate or reimburse reported losses. When contacted, the public bank's press office reiterated that service normalization is expected by the weekend, without providing technical information about the incident.

Lottery outlets function as an extension of the banking network in thousands of Brazilian municipalities, often serving as the only financial service point available. Government data indicates that more than 30 million Brazilians do not have a bank account, and the outlets' reach — over 13,000 units — has turned them into hubs for bill payments, social benefit collection, and deposits. The cyberattack therefore exposes the country's dependence on a network that, though private, fulfills a public role in financial inclusion.

Caixa has not disclosed whether the incident involved a ransomware attack, unauthorized access, or a configuration failure. No official statement has addressed any leakage of personal data from customers or business owners. The imposed restrictions appear to be containment measures while technical teams work to recover systems. So far, no group has claimed responsibility for the attack, and the bank's press office has only confirmed the incident and the expected date for normal operations.

For those who depend on lottery outlets, the recommendation is to avoid transactions exceeding R$2,000 until Monday, July 27, and to seek alternative channels — such as banking correspondents, ATMs, or digital platforms — for larger amounts. For business owners, the current priority is to document losses and await a more detailed response from Caixa regarding potential compensation. As the system remains partially offline, the unbanked population faces yet another barrier to accessing basic financial services.