French bank Crédit Mutuel Arkéa hit by $133 million supply chain attack

What is confirmed

The bank characterized the incident as a sophisticated external attack and explicitly denied it was the result of human error ^[8][12]. It also rejected reports that the point of entry was Fortuneo, its online banking subsidiary ^[7][11].

According to the bank, the incident had no impact on customer assets and the money moved out of an account belonging to Crédit Mutuel Arkéa itself, not from customer accounts ^[1][14].

The bank reported that some of the stolen funds have already been frozen ^[1][11].

What is not yet confirmed

The bank has not confirmed the exact amount lost, though it stated the reported figure of €118 million ($133 million) is in the right range ^[1][14].

ZachXBT said he was highly confident that the Lazarus Group was not responsible for the incident ^[8].

What to watch next

What we don't know

• What is the final, verified amount of financial loss?
• Who was the unnamed third-party service provider whose platform was compromised?
• What specific technical vulnerability in the provider's platform was exploited?