What happened. Crédit Mutuel Arkéa, the Brittany-based cooperative banking group, disclosed on Nov 4 that attackers got in through the platform of one of its service providers and used the bank's own account to send fraudulent transfers to other banks. On Nov 5 it told Reuters about €100 million was missing. The supplier has not been named. Arkéa briefly paused some transfers and says almost all operations resumed on Nov 4.
The numbers. Arkéa says the loss is around €100 million and that part of the money has been blocked. On-chain investigator ZachXBT estimated more than $133 million (about €118 million) moved through crypto exchanges; Arkéa says it cannot confirm that figure, only the rough scale. Customer accounts and its online bank Fortuneo were not involved, it says, and the hit does not threaten its financial strength. Paris prosecutors have opened an investigation.
Why this matters to an enterprise. This is the bank's own money moved through its own payment channel by way of a vendor. Any third party that can start or approve payments on your behalf belongs in the same tier as your own admins: limit what it can send, require out-of-band approval for large transfers, and alert on new beneficiaries.