The IT Nerd

French banking group Crédit Mutuel Arkéa has confirmed (Translation) a sophisticated cyberattack that allowed attackers to initiate fraudulent transfers involving an estimated $133 million.

The November 4 disclosure follows findings from blockchain investigator ZachXBT, who traced suspicious transactions through cryptocurrency exchanges. The bank has acknowledged the approximate scale of the incident but has not confirmed the final amount stolen.

According to the bank, attackers gained access through an unnamed third-party service provider’s platform and used Crédit Mutuel Arkéa’s own account to transfer funds to other financial institutions. The bank said its security systems detected suspicious activity, prompting the temporary suspension of certain transfers. Some funds have been frozen, and recovery efforts are underway.

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“The most dangerous security failures aren’t always vulnerabilities in code. Sometimes they’re flaws in what a business process is willing to trust.

“We need to be careful about drawing conclusions from headlines. We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence. Speculating about which controls failed or how the attackers operated might make for an interesting story, but it doesn’t necessarily make anyone more secure.

“Attackers don’t operate within the neat categories we use to organize our security programs. They combine technical exploitation, manipulation, social engineering, abuse of trusted relationships, and sometimes even physical access. The objective isn’t necessarily to hack a website. It’s to find a path through people, technology, and business processes that produces the outcome they want.

“As this cat-and-mouse game continues to escalate, I’m concerned it will become increasingly difficult to distinguish what happened from what we believe happened. And that’s a dangerous place for the security industry to find itself.

“This is why we need to stay grounded in established countermeasures and, more importantly, test whether they work together. Least privilege, separation of duties, independent authorization, and transaction monitoring all matter. But we must also prioritize end-to-end offensive testing that challenges business logic, trust relationships, and the consequences of combining weaknesses across systems.

“A vulnerability scanner might tell you whether a system has a known weakness. It won’t necessarily tell you whether someone can manipulate an otherwise legitimate business process to accomplish something that should never have been possible.

“The question isn’t simply whether someone can break into your systems. It’s whether they can make your systems do something they were never supposed to do. And that’s something we need to test, not assume.”

Waseem Ahmed, Head of Engineering, Secure.com

Q: What stands out in the Crédit Mutuel Arkéa incident?

“The money left the bank’s own account, not customer accounts, and the bank says no customer assets were affected. Fraud controls are usually tuned hardest for customer accounts, and a bank’s own account moves large sums every day, so one more large transfer to another institution can be harder to spot. I don’t know how Arkéa’s controls are set up, so that is a general observation.

“The bank says the attackers came in through a service provider’s platform. Any supplier whose platform has a path into your systems is part of your payment chain, whether or not it was meant to be, and it needs the same controls as the rest of that chain.”

Q: What should banks check now?

“Test one path first: can someone who comes in through a supplier’s access send a payment to a beneficiary you have never paid before? Then cap outflows from your own accounts, counted across every system that can send money and over several days. Once outflows pass that cap, new or unusual payments should wait for approval.”

Q: What is still unknown?

“ZachXBT says the activity ran for several days, while the bank says its systems flagged it quickly. Those may not conflict. Part of those days may be spent converting and laundering the money on crypto platforms after it left the bank, which happens largely outside the bank’s view.

“The bank has not named the supplier or said how access was gained, and the $133 million figure is an estimate, not a confirmed total. The bank says no internal error was involved. As I read it, that refers to its own staff, not to how the supplier obtained access, so it is too early to say whether credentials were stolen.”

First a hack of a Bitcoin exchange. Now this. I am starting to see a trend here. And not a very good one. Regardless. financial companies need to take action ASAP as clearly these intuitions are targets.

France’s national blood service, Établissement français du sang (EFS), has confirmed a cyberattack affecting refrigeration equipment at three of its facilities after attackers compromised a third-party cooling equipment provider.

The incident occurred overnight November 1–2 and involved unauthorized changes to temperature and defrost settings in cold-storage systems used to preserve blood plasma.

According to French reporting, hackers attempted to change refrigeration settings from approximately -30°C (-22°F) to 110°C (230°F). While EFS confirmed that temperature and defrost thresholds were raised to extremely high levels, the actual temperatures inside the storage units were not confirmed.

Thankfully, its monitoring and alarm systems detected the anomalies and staff disconnected and secured affected equipment and moved blood products to other facilities before any blood products or samples were damaged.

Damon Small, Board Member, Xcape, Inc.

“This incident represents a troubling escalation in an ongoing campaign. Adversaries appear to be pivoting from disrupting food supplies in grocery stores to directly threatening patient care. We should expect these attacks to continue and potentially evolve from nuisance incidents into operations with much more harmful consequences.

“The fact that no group has claimed responsibility for these ongoing attacks in Europe and the United States is telling. This is not cyber vandalism; this is terrorism. As previously reported, the European countries targeted in this campaign share a common characteristic: they have all provided tangible support to Ukraine.

“Any device capable of affecting human safety that is connected to the Internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”

ㅤ

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“We’ve spent years telling organizations that third-party access is a security risk. This incident is a reminder that sometimes the consequences aren’t measured in stolen records or encrypted servers, but in degrees Celsius. And when we’re talking about blood plasma, that’s a very different kind of ransomware nightmare.

“From my experience in offensive security, what stands out isn’t simply that attackers reportedly manipulated refrigeration settings. It’s the architectural seam that allowed a compromise involving a third-party provider to affect systems responsible for maintaining critical medical supplies. That’s where the real security questions begin. What authority did that provider have? How was access controlled? Could those changes have been prevented or constrained before they reached the equipment?

“There’s also an important distinction between changing a temperature setpoint and changing the physical temperature. We shouldn’t confuse an attempted manipulation with a confirmed physical consequence. Fortunately, the reported monitoring, alarms, and staff response appear to have prevented damage.

“The lesson isn’t simply to secure the refrigerator. It’s to validate the entire chain of trust, from third-party access to operational controls, independent monitoring, and human intervention. Security isn’t what we assume the architecture will prevent. It’s what we can demonstrate the architecture will withstand when something goes wrong.”

Mark my words. This is just the beginning. More countries are going to be targeted. More environments are going to be targeted. Don’t let you be one of those targeted.

By the way, why do these even need to be on the Internet at all? Asking for a friend.

UPDATE: Aras Nazarovas, Senior Information Security Researcher at Cybernews said this:

“Refrigeration systems are just one example of equipment that can be controlled remotely and therefore compromised. Similar risks exist for heating and ventilation systems, water treatment facilities, pharmaceutical storage, and industrial machinery. If attackers gain access to these systems, they may be able to wreak havoc on other essential services or damage goods, without ever physically entering the attacked facility.”

Why do these attacks keep happening and how can organizations prevent similar attacks?

“Many organizations rely on third-party providers to remotely monitor and maintain their equipment. This may make maintenance easier, but it also means a potential entry point for hackers. If remote access isn’t properly secured, attackers may be able to use stolen passwords or software vulnerabilities to gain control of systems. And once they’re inside, they could change temperature settings just as a legitimate technician would. This is especially concerning when the same service provider manages equipment for multiple organizations – compromising one provider could potentially expose several customers.”

“To stay safe from these attacks, organizations should limit remote access to essential personnel and trusted suppliers, require multi-factor authentication, and keep control systems updated. It is also important to learn from such cases, with the attacks against France’s Blood Banks, they were able to quickly identify the attack and move the sensitive supplies to other, unaffected units. This highlights the importance of constant monitoring and having an actionable incident response plan, especially as these attacks start to become more common.”

Speaking at the France Quantum conference, Samih Souissi, ANSSI’s chief of staff, announced it will stop certifying security products that do not incorporate quantum-resistant encryption beginning in 2027.

ANSSI said organizations should be purchasing only quantum-safe products by 2030 as part of a broader national transition strategy.

The policy is intended to address concerns over “harvest now, decrypt later” attacks. ANSSI officials said the transition is not solely a technical challenge but also involves governance, regulation, industrial planning, and national sovereignty considerations.

France’s announcement aligns with broader European efforts to prepare for post-quantum cybersecurity. The European Union has called on member states to begin transitioning to post-quantum cryptography by the end of 2026 and to secure critical infrastructure with quantum-resistant protections by 2030. 

Josh Marpet, Senior Product Security Consultant, Finite State:

   “Considering that certificate lifespans are down to 47 days as per 2029, and Google’s timeline for post quantum cryptography is 2029, and every single cipher suite used currently is deprecated by NIST in 2030, this actually sounds about right. In the next 12 months, if you don’t have a plan to inventory all Asymetric cryptography in your environment and start prioritizing and phasing out all non-post-quantum-cryptography, then you’ve got a problem!

   “The priority, of course, is all sensitive (restricted/confidential/your choice) information sent over the open internet. This is where it will get harvested from. Internal data transfers from a data storage location to a data processing location, are, of course, important and need to be protected, but it’s much harder for someone to harvest it trivially. Also, internal data movement should be covered under your zero-trust initiative. You’ve got that running now, right? Just checking.”

John Strand, Owner, Black Hills Information Security, Inc. has this commentary:

   “Quantum computing deserves attention, but it shouldn’t become a distraction. Organizations should be aware of the long-term implications and monitor developments closely, especially as we move toward 2030. However, the heavy lifting around post-quantum cryptography belongs primarily to the vendors building the hardware, software, and security products that the rest of us rely on. For most enterprises, the biggest risks today still come from weak identities, poor visibility, unpatched systems, and basic security failures. Focus on getting the fundamentals right while keeping an eye on where quantum technology is headed.”

Steven Swift, Managing Director, Suzu Labs provided this:

   “Encryption standards improve over time to keep up with compute. It used to be that once an encryption algorithm was broken, it was time to replace it. These days, we’ve had enough examples of what happens when previously adequate algorithms are defeated by ever more compute. So we plan for the future. This is a double-edged sword.

   “On one hand, bulk data collection of encrypted traffic has been well documented to exist. Theory is that if/when we get enough compute to break the encryption, that even if the data is old, some of it will have value. Quantum computing is the technology most commonly discussed as having the potential to allow bulk decryption of such data to happen.

   “And on the other hand, we already have robust quantum-resistant encryption algorithms available. These haven’t been widely adopted, because for the most part they’re overkill. Today. But planning for the future makes sense.

   “Improving our encryption standards now, well ahead of the time when they may be broken in the future seems like a rational thing to do. Industry adoption is always slow, especially without a mandate. And even once adopted, there are always huge numbers of unsupported devices well past their end-of-life dates.”

Sharon Hagi, CSO, Finite State adds this:

   “ANSSI’s direction is correct in principle. Harvest-now-decrypt-later is a threat vector, and waiting until quantum-capable adversaries are operational to begin transitioning is not a strategy… more like prayer. The policy signal matters.

   “That said, the framing deserves a bit of refinement.

   “Data has a sensitivity half-life. Confidentiality, integrity, and availability requirements are not static properties, they decay at rates determined by the nature of the data and its operational context. A company’s quarterly earnings figures are crown jewels until the 8-K hits the wire, at which point they’re public record. Acute medical telemetry from a connected device is operationally critical for minutes to hours; its clinical relevance, and therefore its confidentiality exposure, decays rapidly. Blanket government and institutional risk assessments that treat all encrypted traffic as equivalently sensitive over decade-long windows are analytically imprecise.

   “The risk model needs to incorporate:

•    “Data classification over time, not just at point of creation or encryption
•    “Threat actor targeting probability — most adversaries harvesting traffic today are after high-value, long-lived secrets (state intelligence, PII, financial infrastructure), not device telemetry or operational status pings
•    “Actual attack surfaces specific to device class and deployment context

   “The quantum threat is not uniformly distributed across the cryptographic stack. Shor’s algorithm breaks RSA and ECC. It does not break AES-256 or SHA-3 in any operationally practical sense — Grover’s provides at most a quadratic speedup, and the effective security margins of properly sized symmetric primitives still holds for most uses. Architectures that rely on symmetric encryption with out-of-band or pre-provisioned key distribution remain meaningful options for resource-constrained embedded devices where NIST PQC algorithms (e.g. ML-KEM, ML-DSA) impose non-trivial compute, bandwidth and memory costs.

   “This doesn’t mean symmetric-only designs are the answer — key management at scale without quantum safe equivalent asymmetric crypto is a real operational burden. But it means the engineering solution space is alot bigger and richer than “migrate everything to PQC or you’re exposed.”

   “What’s missing from the policy conversation is a differentiated threat and risk assessment framework — one that accounts for data lifetime and sensitivity decay rate, device class, computational constraints, and realistic adversary capability timelines. The mandate to transition is right. The precision of the planning and execution model needs work. The regulatory momentum is valuable for Finite State as having these conversations with customers about incorporating quantum crypto standards into their product security designs is exactly why we’re here.”