The IT Nerd

French banking group Crédit Mutuel Arkéa has confirmed (Translation) a sophisticated cyberattack that allowed attackers to initiate fraudulent transfers involving an estimated $133 million.

The November 4 disclosure follows findings from blockchain investigator ZachXBT, who traced suspicious transactions through cryptocurrency exchanges. The bank has acknowledged the approximate scale of the incident but has not confirmed the final amount stolen.

According to the bank, attackers gained access through an unnamed third-party service provider’s platform and used Crédit Mutuel Arkéa’s own account to transfer funds to other financial institutions. The bank said its security systems detected suspicious activity, prompting the temporary suspension of certain transfers. Some funds have been frozen, and recovery efforts are underway.

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“The most dangerous security failures aren’t always vulnerabilities in code. Sometimes they’re flaws in what a business process is willing to trust.

“We need to be careful about drawing conclusions from headlines. We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence. Speculating about which controls failed or how the attackers operated might make for an interesting story, but it doesn’t necessarily make anyone more secure.

“Attackers don’t operate within the neat categories we use to organize our security programs. They combine technical exploitation, manipulation, social engineering, abuse of trusted relationships, and sometimes even physical access. The objective isn’t necessarily to hack a website. It’s to find a path through people, technology, and business processes that produces the outcome they want.

“As this cat-and-mouse game continues to escalate, I’m concerned it will become increasingly difficult to distinguish what happened from what we believe happened. And that’s a dangerous place for the security industry to find itself.

“This is why we need to stay grounded in established countermeasures and, more importantly, test whether they work together. Least privilege, separation of duties, independent authorization, and transaction monitoring all matter. But we must also prioritize end-to-end offensive testing that challenges business logic, trust relationships, and the consequences of combining weaknesses across systems.

“A vulnerability scanner might tell you whether a system has a known weakness. It won’t necessarily tell you whether someone can manipulate an otherwise legitimate business process to accomplish something that should never have been possible.

“The question isn’t simply whether someone can break into your systems. It’s whether they can make your systems do something they were never supposed to do. And that’s something we need to test, not assume.”

Waseem Ahmed, Head of Engineering, Secure.com

Q: What stands out in the Crédit Mutuel Arkéa incident?

“The money left the bank’s own account, not customer accounts, and the bank says no customer assets were affected. Fraud controls are usually tuned hardest for customer accounts, and a bank’s own account moves large sums every day, so one more large transfer to another institution can be harder to spot. I don’t know how Arkéa’s controls are set up, so that is a general observation.

“The bank says the attackers came in through a service provider’s platform. Any supplier whose platform has a path into your systems is part of your payment chain, whether or not it was meant to be, and it needs the same controls as the rest of that chain.”

Q: What should banks check now?

“Test one path first: can someone who comes in through a supplier’s access send a payment to a beneficiary you have never paid before? Then cap outflows from your own accounts, counted across every system that can send money and over several days. Once outflows pass that cap, new or unusual payments should wait for approval.”

Q: What is still unknown?

“ZachXBT says the activity ran for several days, while the bank says its systems flagged it quickly. Those may not conflict. Part of those days may be spent converting and laundering the money on crypto platforms after it left the bank, which happens largely outside the bank’s view.

“The bank has not named the supplier or said how access was gained, and the $133 million figure is an estimate, not a confirmed total. The bank says no internal error was involved. As I read it, that refers to its own staff, not to how the supplier obtained access, so it is too early to say whether credentials were stolen.”

First a hack of a Bitcoin exchange. Now this. I am starting to see a trend here. And not a very good one. Regardless. financial companies need to take action ASAP as clearly these intuitions are targets.