Supply-chain attack · high
Hackers steal about $133 million from Crédit Mutuel Arkéa via third-party service provider
Tier D · Background noise – Good to know
Who’s exposed: Crédit Mutuel Arkéa accounts and its third-party service provider's access
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild
The Brief
- Crédit Mutuel Arkéa, a French cooperative bank, was hit by a cyberattack that enabled fraudulent transactions of up to $133 million.
- The bank says attackers exploited a third-party service provider and used the bank's own account to make the transactions.
- The bank responded by suspending certain systems.
Why it matters
Attackers used a trusted vendor's access rather than breaking the bank's core systems directly, so third-party integrations with access to accounts or payments need the same security scrutiny as internal access.
The checklist behind the tier
Checklist · 1 of 10 yes
| No | Hits tech teams | Judgment: a retail bank's own customer funds were stolen, so this is a non-tech company breach. |
| No | Core infrastructure | Judgment: a single bank's systems via one provider, not widely shared core infrastructure software. |
| No | Popular tool | Judgment: no widely used framework, tool, platform, OS or package is named as the affected product. |
| Yes | Exploited in the wild | BleepingComputer: cyberattack enabled fraudulent transactions of up to $133 million at the bank. |
| No | Public exploit | Neither BleepingComputer nor Security Affairs mentions published exploit code or a proof-of-concept. |
| No | Remote, no login | Neither source describes the attack vector or whether it needed credentials or user interaction. |
| No | Full takeover | Sources say attackers used the bank's own account via a provider but describe no code execution or admin takeover. |
| No | Secrets exposed | Sources report stolen funds only; no stolen credentials, keys, configs or customer data are mentioned. |
| No | Supply chain | Security Affairs: attackers exploited a third-party service provider; no compromised package, update or pipeline is reported. |
| No | No fix yet | Neither source states whether a patch or fix exists for the exploited weakness. |
Timeline
Full coverage · 3 sources
What developers are saying
Based on 3 comments · Mostly critical
Only one of the three Hacker News comments was provided. Its author suggests the attack could be a false flag, arguing that sending small amounts to Lazarus-linked addresses would let the attackers make the theft look like North Korea's work. They also say the FBI was similarly misled after the Binance hack.
- Attribution to North Korea doubted100%
- Planted dust transactions as deception100%
- Past FBI misattribution100%
In favour
Concerns
- − The North Korea attribution may be a deliberate false flag
“send $50k of dust to Lazarus addresses so everyone blames it on North Korea”
“even the FBI bought it with the Binance hack”
First seen · 3 sources · 3 comments · Full story page · How tiers are decided