Hackers pull off $133 million French bank heist via service provider
French bank Crédit Mutuel Arkéa lost $133 million in a cyberattack via a service provider.
Run Crédit Mutuel Arkéa?
Get an email when a reviewed story names Crédit Mutuel Arkéa, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
French bank Crédit Mutuel Arkéa experienced a significant cyberattack, resulting in fraudulent transactions totaling up to $133 million. The attackers exploited a service provider's platform to initiate transactions from the bank's own accounts, converting funds into cryptocurrency. While customer assets remain unaffected, the bank has suspended certain systems and warned of increased phishing risks.
The lesson from this incident
Full lessonAttackers compromised a service provider's platform to initiate fraudulent transactions directly from Crédit Mutuel Arkéa's own accounts, ultimately converting stolen funds into cryptocurrency. This incident illustrates the critical danger of extending implicit trust to third-party vendors without robust oversight of their security posture and access privileges. When a service provider's platform can initiate financial transactions on behalf of a bank, that provider effectively becomes a high-value attack surface that adversaries can exploit indirectly. The subsequent phishing warning also signals that attackers are compounding the breach by targeting customers, amplifying reputational and financial damage beyond the initial heist.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
- malware — USDC
- malware — USDT