I was actually surprised when Kaspersky announced NIC.br was compromised and many banking sites where hijacked. If I remember correctly, they (NIC.br) identified a vulnerability but then denied Kaspersky claims.

https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...