[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl3L4u8MHb2ilCK_89gR5tR-qzva_9I07VB4nB91FaHc":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"cd23f1a4-edf2-4f67-825b-1a3423c79501","$133 million stolen from French bank via exploited service provider","133-million-stolen-from-french-bank-via-exploited-service-provider-4ed525","Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted into cryptocurrency. The French cooperative banking group, which has €211.5 billion in total assets and more than 5.8 million customers, confirmed the attack days after blockchain investigator ZachXBT began tracking over $100 million in suspected stolen funds moving out of centralized exchange accounts. The bank disclosed the … More → The post $133 million stolen from French bank via exploited service provider appeared first on Help Net Security.","Attackers stole approximately $133 million from French banking group Crédit Mutuel Arkéa by initiating fraudulent transactions through a compromised service provider. The stolen funds were moved to other banks, converted into cryptocurrency, and partially laundered through Monero. The bank confirmed the incident, stating it has no impact on customer assets and is cooperating with authorities.","French bank Crédit Mutuel Arkéa loses $133 million in sophisticated cyberattack.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F09\u002Fcredit-mutuel-arkea-cyberattack-133-million\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F02\u002F19151719\u002Fflag-france-1500.webp","2026-11-09T10:03:01+00:00","2026-11-09T11:00:18.342076+00:00",8,[17,20,23,26],{"name":18,"type":19},"Crédit Mutuel Arkéa","vendor",{"name":21,"type":22},"Fortuneo","product",{"name":24,"type":25},"Lazarus Group","threat_actor",{"name":27,"type":28},"cryptocurrency","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[53,56],{"type":46,"value":54,"context":55},"Monero","Used for laundering stolen funds",{"type":57,"value":58,"context":59},"url","https:\u002F\u002Ft.me\u002FZachXBT\u002F208","ZachXBT's initial alert on Telegram regarding suspicious fund movements",[18,21],{"controls":62,"vendors":142},[63,91,120],{"slug":64,"name":65,"problem":66,"products":67},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[68,76,83],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":64,"product_name":80,"url":81,"description":82},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":121,"name":122,"problem":123,"products":124},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"service-provider-compromise-leads-to-133m-bank-heist","Service Provider Compromise Leads to $133M Bank Heist","Attackers exploited a third-party service provider to initiate fraudulent transactions against Crédit Mutuel Arkéa, draining approximately $133 million. This incident illustrates the critical risk of extending trust to external vendors who have access to sensitive financial systems without adequate oversight or controls. The subsequent conversion of funds into cryptocurrency and laundering through Monero demonstrates how quickly stolen assets can be obfuscated once an attacker gains transactional access. Organizations cannot treat third-party access as a lower-risk category — a supplier's compromise is effectively the organization's compromise.",[148,149,150,151,152,153,154],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"DORA Article 9":156,"NIS2 Article 21(2)(b)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 15: Service Provider Management":159,"CIS Control 17: Incident Response Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"DORA mandates that financial entities manage ICT third-party risk rigorously, including contractual obligations, oversight, and security controls for critical service providers — precisely the gap exploited in this incident.","NIS2 requires entities to implement measures addressing supply chain security, including the security of relationships with direct suppliers and service providers, which would have imposed stricter controls on the compromised vendor.","If the service provider's systems contained exploitable vulnerabilities, a structured flaw remediation program mandated across the supply chain would have reduced the attack surface available to the threat actors.","This control requires organizations to establish and maintain an inventory of service providers, assess their security posture, and enforce security requirements — directly addressing the risk of a trusted vendor being used as an attack vector.","A well-practiced incident response plan covering third-party breach scenarios would have enabled faster detection, containment, and coordination with authorities to limit the total value of funds moved and laundered.","Applying technical vulnerability management requirements to third-party suppliers — not just internal systems — would have ensured the service provider maintained a hardened posture before being trusted with transactional access.","Stronger identity verification and access controls on the service provider's credentials and transaction privileges would have prevented attackers from leveraging that compromised access to initiate fraudulent payments."]