Third-Party Risk Lessons From the $133M Arkéa Bank Heist

23 hours ago

8 min read

By Yonatan Hoorizadeh, CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: November 9, 2026

Last updated: November 9, 2026

Attackers stole roughly €100 million from French bank Crédit Mutuel Arkéa by compromising one of its service providers and using that access to send money out of the bank's own account. The lesson for every business: any vendor whose platform can reach your payment systems is part of your payment chain and needs the same controls.

What happened in the Crédit Mutuel Arkéa cyberattack?

Crédit Mutuel Arkéa, a French cooperative banking group, confirmed on November 4, 2026 that attackers reached it through the platform of an unnamed service provider and made fraudulent transfers from the bank's own account to other banks. The bank told Reuters that about €100 million was missing. Blockchain investigator ZachXBT traced roughly $133 million (about €118 million) of stolen funds moving through cryptocurrency exchanges.

Crédit Mutuel Arkéa is not a small target. Help Net Security reported that the group holds €211.5 billion in total assets and serves more than 5.8 million customers. The bank says the losses do not threaten its financial health.

ZachXBT flagged the theft before the bank disclosed it. According to Help Net Security, he first reported over $106 million in suspicious withdrawals from centralized exchange accounts on November 1, taken out as USDC and USDT stablecoins, then swapped into ether and partly converted to Monero. On November 3 he reported another $27 million in withdrawals by the same actor, bringing his total to $133 million.

Crédit Mutuel Arkéa says the attackers did not use customer accounts at its federations or subsidiaries, and that customer assets were not affected. The bank temporarily suspended some transactions to stop further transfers, notified the European Central Bank and French banking supervisors, and is working with French prosecutors, who have opened an investigation. Part of the stolen money has been blocked and recovery efforts are continuing.

Crédit Mutuel Arkéa has also pushed back on parts of the coverage. In its published Q&A, the bank denied that attackers entered through Fortuneo, its online banking subsidiary, and rejected human error on its side as the cause. As of November 9, 2026, it has not named the service provider or explained how that provider was compromised.

Why does a vendor breach at a bank matter to your business?

The Arkéa heist matters outside banking because the money left through a trusted supplier connection, not a hacked customer login. Most mid-market companies have the same shape of exposure: a payroll provider, an accounts payable platform, a banking portal integration, or an IT provider with administrator access to finance systems. Each of those connections can become the route an attacker uses to move a company's money.

Waseem Ahmed, head of engineering at Secure.com, made the point plainly to Hackread: any supplier with a path into your systems "is part of your payment chain, whether or not it was meant to be." Most third-party risk programs were not built that way. They score vendors on a security questionnaire at onboarding and rarely revisit what the vendor's access can actually do.

There is a second detail in this story that business leaders should not skip. The money came out of the bank's own account, not customer accounts. Ahmed told eSecurity Planet that fraud controls are usually tuned hardest for customer accounts, while an institution's own account moves large sums every day, so one more large transfer can be harder to spot.

The same blind spot exists in most companies. Fraud attention goes to customer payments and card transactions, while the corporate operating account, the payroll run, and the accounts payable batch move large amounts on autopilot. A supplier connection into any of those three is the closest equivalent to what happened at Arkéa.

How did the attackers get into the bank?

Crédit Mutuel Arkéa has not said how the service provider was compromised, which provider it was, or how long the attackers had access. The bank describes a sophisticated external attack and rejects human error on its side. What is confirmed is the path: a provider's platform, then the bank's own account, then transfers to other banks and possibly into cryptocurrency.

Some reporting goes further, but it remains unconfirmed. French journalist Grégory Raymond reported on X, citing his sources, that the fraudsters could set the beneficiary name on transfers themselves, and that money was sent to crypto exchange accounts opened under falsified identities, in names matched to pass sender-to-owner checks. Crédit Mutuel Arkéa disputes the Fortuneo part of that account.

Darin Fredde of Ridge Security cautioned in comments to Hackread and eSecurity Planet against reconstructing the attack from headlines. That is the right instinct. The useful question for other organizations does not depend on the exact technique. It is whether access granted to a vendor could both create a new payee and release a payment to it.

What would a vCISO do in the first 72 hours after a story like this?

A virtual Chief Information Security Officer (vCISO) would treat the Arkéa story as a prompt to answer one question quickly: which of our vendors can move money, or change where money goes? That answer drives the rest of the work, from access reviews to bank-side controls to cyber insurance. Most companies can answer it within a week once someone with authority owns the question.

For companies without a full-time security executive, this is typical first-month work for vCISO services or fractional CISO services. The value is not a new tool. It is one accountable person who can pull finance, IT, and procurement into the same room and keep the list current.

Day 1: Build the money-movement vendor list

List every vendor that can touch payments, payroll, accounts payable, treasury, or your banking portal, including integrations and API connections. Add any IT provider with administrator access to the finance systems. For each one, note whether the access is always on or granted only when needed. Standing access to a money-moving system is the first thing to reduce.

Day 2: Separate creating a payee from approving a payment

Confirm that no single identity, internal or vendor, can both add a new beneficiary and release a payment to it. Then test it. Ahmed's suggested exercise is a good one: try to send a payment, through a supplier's level of access, to a beneficiary you have never paid before, and see whether anything stops it before the money leaves.

Day 3: Put limits at the bank and in the contract

Ask your bank which controls you are not using yet. Common options include dual approval and callback verification for new beneficiaries, positive pay for checks, and ACH debit blocks or filters. Ahmed also recommends caps on outflows from your own accounts, counted across every system that can send money and over several days, with new or unusual payments held for approval once the cap is passed.

On the contract side, money-movement vendors should owe you breach notification within hours, not weeks, along with access logs on request. Then check your cyber insurance policy for how it treats funds transfer fraud, especially any sublimit and whether a loss that starts at a vendor is covered.

Why does disclosure speed affect how much stolen money comes back?

The speed of reporting can decide how much stolen money is recovered. In the Arkéa case, ZachXBT argued that the delay before public disclosure let a large share of the funds be laundered before European law enforcement could freeze it. Whether or not that criticism is fair to the bank, the principle applies to every business: the first hours after a fraudulent transfer are the recovery window.

ZachXBT wrote on November 3, as quoted by Help Net Security: "No proper incident disclosure has resulted in $30M+ being laundered away." Crédit Mutuel Arkéa, for its part, says part of the money has already been blocked and that it is too early to state a final loss.

For a mid-market company, the practical version is simple. Your incident response plan should name who calls the bank's fraud team, who files with the FBI's Internet Crime Complaint Center (IC3), and who has the authority to freeze vendor access, all without waiting for a full investigation. If your plan or your incident response services retainer has no payment-fraud scenario, add one and rehearse it in a tabletop exercise.

Which companies should act on this first?

Companies that move large sums through third-party platforms, or that are regulated for vendor oversight, should act first. That includes financial services firms, healthcare organizations, and any business that pays through an accounts payable automation platform or outsourced payroll. Company size changes the scope of the review, not whether the review is needed.

Under about 100 employees: start with the three to five vendors that touch money, plus your IT provider. A one-page access map, kept current, is enough.
Mid-market (100 to 2,000 employees): tier vendors by what their access can do, not by contract value, and review the top tier's access every quarter.
Regulated firms: the FTC Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA) requires covered financial institutions to oversee their service providers, and New York's DFS cybersecurity regulation (23 NYCRR Part 500) requires a third-party service provider security policy. A documented review is the evidence regulators and insurers ask for.

If your company has never reviewed vendors this way, risk assessment services focused on money-movement vendors are a fast and defensible place to start. The scope is small, and the findings tend to be concrete.

Frequently asked questions

Were Crédit Mutuel Arkéa customers' accounts affected by the cyberattack?

Crédit Mutuel Arkéa says no. The attackers used the bank's own account, not customer accounts, and the bank states customer assets were unaffected, although some transfers were delayed while it contained the incident. The bank did warn customers to expect phishing attempts that use the news, and told them never to share login IDs, passwords, card numbers, or SMS verification codes.

Which service provider was breached in the Arkéa attack?

As of November 9, 2026, Crédit Mutuel Arkéa has not named the service provider or disclosed how it was compromised or how long attackers had access. The bank has denied that the entry point was its Fortuneo subsidiary. Treat any claim naming a specific provider as speculation until the bank or investigators confirm it.

How can I tell if a vendor could move money out of my company's accounts?

Ask two questions about each vendor: can its access create or change a payee or bank account detail, and can it release or schedule a payment? If one identity can do both, you have the same pattern as the Arkéa attack. Check vendor user roles in your banking portal, accounts payable tool, and payroll system, review active API tokens, and ask your bank which users and integrations are on your treasury profile.

Does cyber insurance cover a theft that starts at a vendor?

It depends on the policy wording. Funds transfer fraud and social engineering coverage often carry a sublimit well below the policy's main limit, and some policies treat losses that originate at a third party differently from direct attacks. Ask your broker for a written answer to the specific scenario, a vendor's compromised access used to send your money, before you need it.

If you are not sure which of your vendors could move money out of your accounts, that is worth finding out before an attacker does. Purple Shield Security is a cybersecurity consulting firm based in Los Angeles that serves clients nationally, helping small and mid-market companies map vendor access, put approval controls in place, and rehearse the response before it is needed. Contact us to start with a third-party risk review.

Book a third-party risk review