French banking group Crédit Mutuel Arkéa has confirmed (Translation) a sophisticated cyberattack that allowed attackers to initiate fraudulent transfers involving an estimated $133 million.
The November 4 disclosure follows findings from blockchain investigator ZachXBT, who traced suspicious transactions through cryptocurrency exchanges. The bank has acknowledged the approximate scale of the incident but has not confirmed the final amount stolen.
According to the bank, attackers gained access through an unnamed third-party service provider’s platform and used Crédit Mutuel Arkéa’s own account to transfer funds to other financial institutions. The bank said its security systems detected suspicious activity, prompting the temporary suspension of certain transfers. Some funds have been frozen, and recovery efforts are underway.
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“The most dangerous security failures aren’t always vulnerabilities in code. Sometimes they’re flaws in what a business process is willing to trust.
“We need to be careful about drawing conclusions from headlines. We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence. Speculating about which controls failed or how the attackers operated might make for an interesting story, but it doesn’t necessarily make anyone more secure.
“Attackers don’t operate within the neat categories we use to organize our security programs. They combine technical exploitation, manipulation, social engineering, abuse of trusted relationships, and sometimes even physical access. The objective isn’t necessarily to hack a website. It’s to find a path through people, technology, and business processes that produces the outcome they want.
“As this cat-and-mouse game continues to escalate, I’m concerned it will become increasingly difficult to distinguish what happened from what we believe happened. And that’s a dangerous place for the security industry to find itself.
“This is why we need to stay grounded in established countermeasures and, more importantly, test whether they work together. Least privilege, separation of duties, independent authorization, and transaction monitoring all matter. But we must also prioritize end-to-end offensive testing that challenges business logic, trust relationships, and the consequences of combining weaknesses across systems.
“A vulnerability scanner might tell you whether a system has a known weakness. It won’t necessarily tell you whether someone can manipulate an otherwise legitimate business process to accomplish something that should never have been possible.
“The question isn’t simply whether someone can break into your systems. It’s whether they can make your systems do something they were never supposed to do. And that’s something we need to test, not assume.”
Waseem Ahmed, Head of Engineering, Secure.com
Q: What stands out in the Crédit Mutuel Arkéa incident?
“The money left the bank’s own account, not customer accounts, and the bank says no customer assets were affected. Fraud controls are usually tuned hardest for customer accounts, and a bank’s own account moves large sums every day, so one more large transfer to another institution can be harder to spot. I don’t know how Arkéa’s controls are set up, so that is a general observation.
“The bank says the attackers came in through a service provider’s platform. Any supplier whose platform has a path into your systems is part of your payment chain, whether or not it was meant to be, and it needs the same controls as the rest of that chain.”
Q: What should banks check now?
“Test one path first: can someone who comes in through a supplier’s access send a payment to a beneficiary you have never paid before? Then cap outflows from your own accounts, counted across every system that can send money and over several days. Once outflows pass that cap, new or unusual payments should wait for approval.”
Q: What is still unknown?
“ZachXBT says the activity ran for several days, while the bank says its systems flagged it quickly. Those may not conflict. Part of those days may be spent converting and laundering the money on crypto platforms after it left the bank, which happens largely outside the bank’s view.
“The bank has not named the supplier or said how access was gained, and the $133 million figure is an estimate, not a confirmed total. The bank says no internal error was involved. As I read it, that refers to its own staff, not to how the supplier obtained access, so it is too early to say whether credentials were stolen.”
First a hack of a Bitcoin exchange. Now this. I am starting to see a trend here. And not a very good one. Regardless. financial companies need to take action ASAP as clearly these intuitions are targets.
Nearly Nine in Ten Businesses Cannot Leave Their Largest Cloud or Infrastructure Provider Within Three Weeks, Leaseweb Research Finds
Posted in Commentary with tags Leaseweb on November 9, 2026 by itnerdNearly nine in ten (89%) businesses could not migrate business-critical workloads away from their largest cloud or infrastructure provider within three weeks, despite most believing they have control over their data, according to new research from Leaseweb, a global cloud services and Infrastructure as a Service (IaaS) provider.
The Leaseweb Digital Independence Survey 2026, conducted among 800 C-suite leaders in the UK, US, Germany and the Netherlands, found that only 11% of organizations could make the move within this timeframe. More than half (55%) said it would take longer than three months, or was not currently possible.
The Netherlands recorded the highest proportion of businesses expecting migration to take more than three months (65%), followed by the UK (59%), US (55%) and Germany (40%). Dutch businesses also gave the longest average estimated migration time, at 4.7 months.
AI Set to Increase Cloud Provider Lock-In
The challenge for many businesses is that this dependence is expected to grow even further as AI adoption increases. Overall, more than three-quarters (79%) of business leaders expect AI to increase their reliance on a small number of providers over the next three years (89% in the US, 83% in the UK, 76% in Germany, and 67% in the Netherlands).
Geopolitical pressures are also prompting changes to infrastructure strategies. Over three-quarters (78%) have taken action to reduce reliance on a particular technology or infrastructure provider in response to geopolitical challenges, including 91% in the US and 87% in the UK, while 45% of respondents overall plan to take this even further.
Businesses are also placing a clear financial value on independence. Almost all respondents would pay more to gain greater control, reduce provider dependence, or improve their freedom to move, and 73% would pay at least 11% more, with an average premium of approximately 16%. Willingness to pay was highest in the Netherlands, where 81% would pay at least 11% more and 26% would pay at least 21% more, followed by Germany with 79% willing to pay at least 11% more.
“Digital independence comes down to having real choices, and our research shows many businesses have fewer than they think,” said Lex Boost, co-CEO at Leaseweb. “Organizations may believe they control their data, but once applications have been built around a provider’s platform, moving them is rarely quick or simple. With AI expected to tie businesses even more closely to a small number of providers, leaders need to understand and act on those dependencies now, not when a pricing change or geopolitical shift forces their hand.”
Additional findings include:
Methodology
Research conducted by Censuswide among 800 C-suite leaders at organizations with 500 to 5,000 employees, with 200 respondents each in the UK, US, Germany and the Netherlands between September 22-30, 2026.
Leave a comment »