[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVuTCDB15lLcK7HI5TQXO4Ewj3yZn0AfZNThwUWataZY":3},{"article":4,"iocs":55,"watch_terms":68,"solutions":69,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"fc625d78-02c3-4a19-8959-0fa823a7f6a7","Attackers Exploit Third-Party Provider to Raid French Bank Crédit Mutuel Arkéa","attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea-bc3b39","French Bank Crédit Mutuel Arkéa says hackers exploited a service provider to steal up to $133 million using the bank’s own account. French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that let attackers make fraudulent transactions of up to $133 million, forcing it to suspend certain systems. Crédit Mutuel Arkéa is a […]","Hackers exploited a third-party service provider to steal approximately $133 million from French bank Crédit Mutuel Arkéa by initiating fraudulent transactions from the bank's own accounts. The bank has suspended certain systems and is working with law enforcement to recover the funds, which were converted into cryptocurrency. Customer assets were unaffected, and the bank has warned of increased phishing risks.","Attackers stole $133M from French bank Crédit Mutuel Arkéa via a third-party provider.","https:\u002F\u002Fsecurityaffairs.com\u002F202628\u002Fcyber-crime\u002Fattackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-15.png","2026-11-08T10:25:47+00:00","2026-11-08T12:00:21.032607+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"WellWallet","vendor",{"name":21,"type":19},"Kyrrex",{"name":23,"type":19},"Wagyu",{"name":25,"type":26},"Lazarus Group","threat_actor",{"name":28,"type":29},"Fortuneo","product",{"name":31,"type":19},"Crédit Mutuel Arkéa","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[56,59,62,65],{"type":54,"value":57,"context":58},"XMR","Monero cryptocurrency used for laundering stolen funds.",{"type":54,"value":60,"context":61},"USDC","USD Coin stablecoin used in the theft and laundering.",{"type":54,"value":63,"context":64},"USDT","Tether stablecoin used in the theft and laundering.",{"type":54,"value":66,"context":67},"ETH","Ethereum cryptocurrency used for swapping stolen stablecoins.",[18,21,23],{"controls":70,"vendors":158},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":101,"name":102,"problem":103,"products":104},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"slug":130,"name":131,"problem":132,"products":133},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"third-party-provider-exploited-to-steal-133m-from-french-bank","Third-Party Provider Exploited to Steal $133M from French Bank","Attackers compromised a third-party service provider that had privileged access to Crédit Mutuel Arkéa's systems, using that foothold to initiate fraudulent transactions directly from the bank's own accounts. This incident illustrates the systemic risk of extending implicit trust to external vendors without rigorous ongoing oversight and least-privilege enforcement. The conversion of stolen funds into cryptocurrency highlights the speed at which financial damage can become irreversible. Banks and financial institutions must treat third-party access as a critical attack surface requiring the same controls as internal systems. The knock-on phishing risk to customers further amplifies the reputational and regulatory consequences of a single supply-chain failure.",[164,165,166,167,168,169,170],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","DORA Article 9","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"DORA Article 9":172,"NIS2 Article 21(2)(b)":173,"MITRE ATT&CK T1566: Phishing":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"CIS Control 17: Incident Response Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"DORA mandates that EU financial entities manage ICT third-party risk rigorously, including security requirements in contracts and ongoing monitoring of providers—controls that could have detected or prevented this vendor compromise.","NIS2 requires essential and important entities to implement supply-chain security measures, including assessment of the security practices of direct suppliers, which would have flagged the third-party provider as a risk.","The bank's warning of increased post-incident phishing risk reflects a secondary attack vector; proactive employee and customer awareness programs aligned with this technique would reduce successful follow-on social-engineering attempts.","Maintaining continuous visibility into the security posture of third-party components and requiring timely remediation of vulnerabilities in vendor-managed systems would reduce the exploitable attack surface.","A tested incident response plan covering supply-chain breaches would have enabled faster containment of the fraudulent transactions before funds were converted to cryptocurrency.","Applying vulnerability management obligations to third-party-managed systems and requiring evidence of patching compliance would have reduced the exploitable weaknesses accessible through the provider.","The attackers leveraged the third-party provider's access to execute fraudulent transactions; enforcing least-privilege and strong authentication on all vendor accounts would have limited the blast radius."]