Crédit Mutuel Arkéa: attackers exploited third-party provider to make fraudulent transactions up to $133M
Severity: high · Patch status: no-fix-needed · Since 2026-11-08
French cooperative bank Crédit Mutuel Arkéa disclosed a cyberattack in which hackers exploited a third-party service provider to gain access and execute fraudulent transactions of up to $133 million using the bank's own account. The incident forced the bank to suspend certain systems while it investigated and contained the attack. The compromise originated through the supply chain rather than the bank's own infrastructure, highlighting third-party risk in banking. No specific CVE or malware name is associated; details on the provider, exact loss, and recovery of funds are not stated in the source. Customers may face transaction disruptions while suspended systems are restored.
What to do
- Review and harden access controls and transaction limits for third-party providers connected to your banking systems
- Monitor accounts and payment flows for anomalous or fraudulent transactions
- Suspend or isolate affected integrations until integrity is confirmed
- Assess third-party vendors' security posture and require incident disclosures
- Notify regulators and customers as required and communicate any service disruptions
Sources
All live incidents on Threat Watch
