Third-party breach enables major theft from French bank
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, November 9th, 2026.
A cyberattack routed through a service provider allowed attackers to execute fraudulent transactions from Crédit Mutuel Arkéa’s own account. The bank acknowledged losses in the order of one hundred euros million. An outside blockchain researcher estimated the amount could be as high as one hundred eighteen euros million, or one hundred thirty three dollars million, although that higher figure hasn’t been confirmed by the bank.
Customer assets were not affected. Even so, certain systems were suspended and some transfers were delayed. The bank says the incident is contained and operations are resuming after checks and enhanced controls.
The key issue is the authority available through the provider. For leaders, vendor reviews need to consider the transactions a provider can enable, not only the data it can see. For defenders, third-party sessions and unusual transfers deserve the same monitoring as internal privileged accounts. The attackers remain unidentified, and the final loss is still unresolved.
Review every provider capable of initiating transactions, then enforce limits, rapid suspension controls and independent approval for unusual transfers.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
