The money came out of the bank’s own account. The route in ran through a supplier.
French banking group Crédit Mutuel Arkéa disclosed on Nov. 4 that attackers used a service provider’s platform to reach the bank and make fraudulent transfers. The bank says customer assets were unaffected, but the incident puts supplier access to payment systems under scrutiny.
For security and fraud teams, the practical question is how far a trusted external connection can reach—and which controls can stop it from moving money.
What Arkéa has confirmed
In its follow-up disclosure, Arkéa said attackers transferred funds from its own account to other banking institutions. Those transfers could potentially have enabled cryptocurrency conversion through specialized platforms.
The bank denied that attackers entered through its Fortuneo subsidiary. It has not named the supplier or disclosed the initial compromise method.
Arkéa declined to confirm a reported €118 million, approximately US$133 million, theft, while acknowledging that the figure’s order of magnitude was accurate. Some funds were blocked, recovery efforts continued, and the final financial impact remained under assessment.
Its initial statement said it temporarily suspended some transactions to prevent further fraudulent movements. Certain customer transfers were delayed. In its follow-up statement, Arkéa said almost all operations had resumed on the morning of Nov. 4 after additional checks and stronger security measures.
The bank also warned customers about possible follow-on phishing. It advised them to avoid sharing banking credentials or SMS validation codes and to contact their adviser directly to check suspicious messages.
Supplier access can carry consequences beyond the supplier
Waseem Ahmed, head of engineering at Secure.com, said the distinction between customer accounts and a bank’s own account deserves attention.
“Fraud controls are usually tuned hardest for customer accounts, and a bank’s own account moves large sums every day, so one more large transfer to another institution can be harder to spot,” Ahmed said. “I don’t know how Arkéa’s controls are set up, so that is a general observation.”
His broader concern is the authority an external platform can exercise once connected to financial systems.
“Any supplier whose platform has a path into your systems is part of your payment chain, whether or not it was meant to be, and it needs the same controls as the rest of that chain,” he said.
Third-party access can affect very different business functions. In a separate incident, attackers reportedly changed refrigeration settings at French blood bank facilities through a supplier breach, although monitoring prevented damage to stored products.
Elsewhere, poisoned cPGuard security updates compromised nearly 3,000 servers. These cases illustrate different forms of supplier risk; neither establishes how the Arkéa attack worked.
The missing details matter
Darin Fredde, senior director and offensive security evangelist at Ridge Security, cautioned against reconstructing an attack from incomplete disclosures.
“We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence,” Fredde said. “Speculating about which controls failed or how the attackers operated might make for an interesting story, but it doesn’t necessarily make anyone more secure.”
Arkéa said its systems identified suspicious activity quickly and rejected human error within the bank as the cause. That statement does not establish whether the supplier suffered credential theft, exploitation of a software flaw, or another form of compromise.
Fredde said attackers can combine technical exploitation, social engineering, and abuse of trusted relationships to reach a business objective. Security testing therefore needs to examine what those weaknesses permit when combined.
“A vulnerability scanner might tell you whether a system has a known weakness. It won’t necessarily tell you whether someone can manipulate an otherwise legitimate business process to accomplish something that should never have been possible,” he said.
What banks should test across the payment chain
Ahmed recommends starting with one concrete scenario: whether someone entering through supplier access can send a payment to a beneficiary the bank has never paid before.
That gives security, treasury, and fraud teams a shared test objective. The exercise should establish which identity can create a beneficiary, which identity can authorize payment, and whether the approval remains independent when an external connection is compromised.
Fredde recommends testing least privilege, separation of duties, independent authorization, and transaction monitoring together. A penetration testing program can incorporate those business outcomes into its scope, alongside technical weaknesses.
Based on their recommendations, banks can organize the review around four checks:
- Trace supplier authority. Identify the accounts, integrations, and permissions that connect each provider to payment functions. Establish whether access intended for support or data exchange can also initiate or alter transactions.
- Test independent approval. In a controlled exercise, verify that a compromised supplier identity cannot both request a sensitive change and satisfy the approval required to execute it.
- Measure cumulative outflows. Ahmed recommends caps on payments from the bank’s own accounts across every system capable of sending money and over multiple days. Once the threshold is crossed, new or unusual payments should wait for approval.
- Verify intervention. Establish who receives an alert, who can hold a payment, and who can disable supplier access. Record whether those actions happen before the simulated payment completes.
These are proposed checks for other institutions, not findings that Arkéa lacked those controls. Thresholds and approval rules should reflect each bank’s payment volumes and operating requirements.
The useful result is evidence showing whether the tested supplier connection permits unauthorized payments, whether monitoring detects the attempt, and whether staff can intervene before funds leave. A vendor assessment or a clean vulnerability scan alone cannot demonstrate that outcome.
Stay informed: Follow the cybersecurity threats and supplier risks affecting European businesses. Subscribe to Tech Insider Europe for free coverage of the region’s technology, AI, and security developments.