I'll update this story if the bank or investigators share more details.

◢What happened

The bank disclosed it on November 4 in a press release and a questions and answers page¹. The attackers used Crédit Mutuel Arkéa's own account to send transfers to other banks, which then likely let them convert the money into cryptocurrency on specialized platforms. They did not use customer accounts.

Once it detected the attack, the bank suspended some transactions as a precaution, so some customer transfers were delayed. It says almost all of them resumed on the morning of November 4 and that the incident is under control.

◢What we know

• ▹The attackers came in through a service provider's platform, not through the bank's online subsidiary Fortuneo, as had been reported. That's what the bank says in its note¹.
• ▹The money left the bank's own account, not its customers' accounts. The bank says the attack has no impact on customers' savings.
• ▹On the 118 million euros, the bank¹ does not confirm the figure, only the "order of magnitude". Part of the money has been blocked and other steps are under way to recover it.
• ▹It rules out human error at the bank and describes a "sophisticated attack" from outside. It is working with the police and judicial authorities to establish the origin and method, and has informed its supervisors.
• ▹It warns customers that phishing attempts tend to rise after attacks like this, and asks them not to share details by phone or email.

◢What we don't know

The bank hasn't said which provider it was, what service it provided or how its platform was used to reach the account. There is also no final figure for what was stolen or recovered, and nobody has publicly said who is behind it. According to BleepingComputer², the bank had not yet answered its questions.

◢What it means for a regular company

You don't need to be a bank for this to affect you. What keeps coming up in attacks is that they don't come in through your server, but through someone trusted who already has access: a vendor, a connected tool or an outside account. I wrote about it in attacks don't come in through the server.

A few questions worth asking this week:

1. ▹List the vendors that can touch your systems or move money, and what permissions each one has.
2. ▹Remove access nobody uses any more and limit the rest to what they actually need.
3. ▹Set limits and alerts on payments and transfers leaving your accounts, especially large ones or ones going to new destinations.
4. ▹If a vendor has an incident, know who tells you and how fast. Put it in the contract.
5. ▹Warn your team and your customers that fake emails follow an attack. If you're unsure about a message, see how to spot a phishing email.

If you want your staff to recognize these risks, including vendor risk, that's part of what I cover in my cybersecurity and AI training.