[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3yrzKLZTNiMamVGPZfACoNybNQhD8jrlDAsQpGwKRDQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"ba18f74b-9e8b-4ed0-8c94-7f25a8c5ac79","100m-bank-fraud-via-compromised-supplier-platform","39ed311a-3175-4e32-b0b9-2632dab975fd","€100M Bank Fraud via Compromised Supplier Platform","Attackers exploited a third-party supplier platform to gain access to Crédit Mutuel Arkéa's internal systems and initiated fraudulent transfers using the bank's own accounts, highlighting a critical failure in third-party risk management. The use of legitimate bank accounts for the transfers suggests attackers obtained valid credentials or session tokens through the supplier platform, bypassing direct bank defenses. This incident underscores how a trusted supplier relationship can become an invisible backdoor into even well-defended financial institutions. The conversion of funds to cryptocurrency further complicates recovery, illustrating why rapid detection and transaction monitoring are essential. Financial institutions must treat third-party platforms with the same scrutiny as their own internal systems.","**Immediate actions:**\n- Revoke and rotate all credentials and API tokens associated with the compromised supplier platform immediately.\n- Implement emergency transaction holds and anomaly-detection rules on large or unusual outbound transfers pending investigation.\n\n**Long-term improvements:**\n- Enforce strict third-party vendor risk assessments, including mandatory security audits and contractual security standards before granting platform access.\n- Apply the principle of least privilege to all supplier integrations, ensuring supplier platforms can only access the minimum data and functions required.\n- Implement strong multi-factor authentication (MFA) and privileged access management (PAM) for all third-party connections to core banking systems.\n\n**Detection measures:**\n- Deploy real-time transaction monitoring with behavioral analytics to flag transfers deviating from established baselines, especially those converting to cryptocurrency.\n- Establish continuous logging and alerting on all actions performed via third-party supplier platforms, with alerts reviewed by an internal security team.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"DORA Article 9":20,"NIS2 Article 21(2)(b)":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 15: Service Provider Management":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"DORA mandates that financial entities implement ICT security measures for third-party ICT service providers, directly applicable to this incident where a supplier platform was the attack vector causing significant financial loss.","NIS2 requires incident handling and supply chain security measures, obligating entities like Crédit Mutuel Arkéa to assess and manage the cybersecurity risks posed by their third-party suppliers.","If the supplier platform contained exploitable vulnerabilities, a structured flaw remediation program requiring timely patching of third-party software would have reduced the attack surface.","This control requires organizations to establish and maintain a process to evaluate service providers, ensuring suppliers with access to systems meet defined security standards — directly addressing the failure to secure the third-party platform that was exploited.","A well-practiced incident response plan with pre-defined playbooks for fraudulent financial transfers could have accelerated detection, containment, and recovery, potentially limiting the total financial loss of €100 million.","This control requires organizations to manage technical vulnerabilities in a timely manner, including those present in supplier-managed systems that have access to the organization's environment.","Enforcing strong authentication and least-privilege access on the supplier platform integration would have prevented attackers from leveraging the bank's own accounts to conduct fraudulent transfers.","published","2026-11-09T11:20:21.321279+00:00","2026-11-09T11:20:21.304+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fhackread.com\u002Fhackers-steal-e100m-credit-mutuel-arkea-supplier-platform\u002F","hackers-steal-around-100-million-from-credit-mutuel-arkea-through-supplier-platf-ef43df","Hackers Steal Around €100 Million From Crédit Mutuel Arkéa Through Supplier Platform",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":58,"name":59,"problem":60},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]