Hackers Steal Around €100 Million From Crédit Mutuel Arkéa Through Supplier Platform
Hackers stole around €100 million from Crédit Mutuel Arkéa via a supplier platform.
Crédit Mutuel Arkéa has lost approximately €100 million due to a cyberattack that exploited a third-party supplier platform. Attackers used the bank's own accounts for fraudulent transfers, potentially converting funds to cryptocurrency. While customer funds were unaffected, recovery efforts are ongoing, and French authorities have launched an investigation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Crédit Mutuel Arkéa?
Get an email when a new story names Crédit Mutuel Arkéa, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited a third-party supplier platform to gain access to Crédit Mutuel Arkéa's internal systems and initiated fraudulent transfers using the bank's own accounts, highlighting a critical failure in third-party risk management. The use of legitimate bank accounts for the transfers suggests attackers obtained valid credentials or session tokens through the supplier platform, bypassing direct bank defenses. This incident underscores how a trusted supplier relationship can become an invisible backdoor into even well-defended financial institutions. The conversion of funds to cryptocurrency further complicates recovery, illustrating why rapid detection and transaction monitoring are essential. Financial institutions must treat third-party platforms with the same scrutiny as their own internal systems.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.