[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOJ-Bqe9IUKnvTB-sR_QCnP9gmim8uBvNQxVbh-lZfjw":3},{"article":4,"iocs":46,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3aa6a07f-e262-4f8e-80e4-47ddad4b7e86","Hackers pull off $133 million French bank heist via service provider","hackers-pull-off-133-million-french-bank-heist-via-service-provider-afb296","French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]","French bank Crédit Mutuel Arkéa experienced a significant cyberattack, resulting in fraudulent transactions totaling up to $133 million. The attackers exploited a service provider's platform to initiate transactions from the bank's own accounts, converting funds into cryptocurrency. While customer assets remain unaffected, the bank has suspended certain systems and warned of increased phishing risks.","French bank Crédit Mutuel Arkéa lost $133 million in a cyberattack via a service provider.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-pull-off-133-million-french-bank-heist-via-service-provider\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F06\u002Ffinancial-theft.jpg","2026-11-07T15:25:35+00:00","2026-11-07T16:00:22.207406+00:00",7,[17,20],{"name":18,"type":19},"Crédit Mutuel Arkéa","vendor",{"name":21,"type":22},"Fortuneo","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50],{"type":35,"value":48,"context":49},"USDC","Stolen funds converted to USDC stablecoin",{"type":35,"value":51,"context":52},"USDT","Stolen funds converted to USDT stablecoin",[18,21],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":86,"name":87,"problem":88,"products":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":115,"name":116,"problem":117,"products":118},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"third-party-platform-exploited-to-drain-133m-from-french-bank","Third-Party Platform Exploited to Drain $133M from French Bank","Attackers compromised a service provider's platform to initiate fraudulent transactions directly from Crédit Mutuel Arkéa's own accounts, ultimately converting stolen funds into cryptocurrency. This incident illustrates the critical danger of extending implicit trust to third-party vendors without robust oversight of their security posture and access privileges. When a service provider's platform can initiate financial transactions on behalf of a bank, that provider effectively becomes a high-value attack surface that adversaries can exploit indirectly. The subsequent phishing warning also signals that attackers are compounding the breach by targeting customers, amplifying reputational and financial damage beyond the initial heist.",[149,150,151,152,153,154,155],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management",{"DORA Article 9":157,"MITRE ATT&CK T1566: Phishing":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 15: Service Provider Management":160,"CIS Control 17: Incident Response Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"As a financial entity, Crédit Mutuel Arkéa is required under DORA to manage ICT third-party risk rigorously, including ensuring that service providers maintain adequate security controls over systems that can affect the bank's financial operations.","The bank's warning of increased phishing risks post-breach reflects adversaries using the incident as a pretext for follow-on social engineering attacks against customers, a known technique that must be anticipated in incident response planning.","If the service provider's platform contained unpatched vulnerabilities that enabled exploitation, a disciplined flaw remediation program across all vendor-managed systems would have reduced the attack surface.","The attack exploited a service provider's platform; this control requires organizations to inventory, assess, and monitor third-party providers to ensure they meet security requirements before being granted access to critical systems.","The bank suspended systems and issued customer warnings reactively; a pre-defined incident response plan covering third-party compromise scenarios would have enabled faster containment and clearer public communication.","The compromised service provider platform represents an unmanaged vulnerability in the supply chain; this control requires organizations to extend vulnerability management obligations to externally managed systems handling sensitive operations.","Attackers leveraged the service provider's legitimate access to initiate fraudulent transactions; enforcing strong authentication and least-privilege access for third-party integrations would have constrained the blast radius."]