French banking group Crédit Mutuel Arkéa confirmed it was hit by a cyberattack in which fraudulent transfers of about €118 million, about $133 million, were made. According to the bank, the attackers did not get in through the group's digital bank, Fortuneo, but through the technology platform of one of its outside vendors. The bank rejected the suggestion that human error was involved and did not name the vendor.
The unusual detail is where the money came from: according to reports, the funds were transferred from the bank's own account to other institutions, and from there may have been converted to cryptocurrency on specialized platforms. The bank said the attack has no financial consequences for customers and that nearly all services have been restored. The amount is not yet final: early reports spoke of about €100 million, and the bank is still assessing the damage and the chance of recovering some of the money.
How the affair came to light is also notable. The suspicious transfers were first flagged by ZachXBT, an independent investigator who tracks fund flows on the blockchain and has exposed major thefts before. On November 4, ZachXBT identified Crédit Mutuel Arkéa as the presumed victim, and only then did the bank issue an official statement.
The bottom line is familiar, but the scale here is unusual: the bank was not breached through its own systems but through a vendor with enough access to move money. Banks spend vast sums securing their systems, but every vendor connected to them, from software companies to payment providers, is another door. This attack shows it takes only one open door.
And in Israel? Banks here also rely on outside vendors for software, cloud and payment services, and banking supervisors already require them to manage that risk. But a requirement on paper is not protection. The question every security chief should ask this week is not whether their systems are protected, but which vendor can move money on their behalf, and what happens if that vendor is breached tomorrow.
