.png)
€100 Million. One Third-Party Breach. How Far Can Trusted Access Reach?
Two financial cyber incidents in two countries reveal a common security challenge: attackers can exploit legitimate access to reach systems responsible for moving money.
ITSEC Asia
A cyberattack against French banking group Crédit Mutuel Arkéa has exposed the financial consequences of compromised third-party access. On 5 November 2026, Reuters reported that approximately €100 million ($112.61 million) was missing following fraudulent transactions carried out using an account belonging to the bank. [1]
The bank had initially disclosed the attack on 4 November. In a subsequent clarification, Arkéa said attackers entered through the platform of one of its service providers, reaching the bank directly. It explicitly denied that its online banking subsidiary Fortuneo was the entry point. Customer accounts were not involved and customer assets remained unaffected. Some transfers were temporarily delayed while the bank contained the incident and secured its operations. The final financial impact was still being assessed. [2][3]
The incident raises an uncomfortable question for financial institutions: how much authority does an external service provider have inside the systems it connects to?
The French incident is not the only recent warning.
On 4 November, India's Computer Emergency Response Team (CERT-In) issued an updated warning about an active campaign it calls Crafty Falcon. The campaign targets banks, non-bank financial companies, fintech platforms, payment aggregators and cryptocurrency exchanges. CERT-In described the use of AI-driven tools to survey targets and invoke victims' own payment and disbursement APIs. The agency also warned that some organisations had been targeted again following incomplete remediation. [4][5]
These are separate incidents, and there is no public evidence linking their perpetrators or methods. But both demonstrate why financial organisations must scrutinise the access granted to external platforms, service identities and application interfaces.
The Hidden Risk Behind Trusted Integrations
Third-party connections often exist for legitimate reasons. Payment processing, reconciliation, cloud operations and transaction management may depend on external platforms with approved access to internal systems.
The problem arises when those permissions extend further than necessary.
In Arkéa's case, the bank confirmed that a provider's platform was used to reach its systems, but has not publicly disclosed the precise technical vulnerability or access mechanism. It would therefore be premature to attribute the incident to a particular API flaw or stolen credential.
India's CERT-In warning provides a separate example of the risks surrounding payment APIs. A valid API request can still be unauthorised at the business level if the system fails to verify the caller's permissions, transaction limits, beneficiary or approval status.
OWASP's API Security Top 10 identifies broken authentication, broken function-level authorisation and unrestricted access to sensitive business flows as major API security risks. [6]
What Financial Organisations Should Test
Security teams should examine how external access connects to critical business processes.
-
Review third-party permissions. Identify every provider with access to applications, cloud environments, payment services and sensitive data. Remove permissions that are no longer required.
-
Separate identities and environments. Vendor accounts, testing credentials and production service identities should not share privileges or secrets.
-
Validate transaction authorisation. Test whether payment endpoints enforce account ownership, beneficiary validation, transaction limits and approval requirements.
-
Test access paths, not just individual endpoints. Examine whether a compromised provider account or application identity can reach other systems.
-
Verify remediation. Retest vulnerabilities and adjacent access paths after changes. Closing one entry point does not guarantee that the wider environment is secure.
Finding Weaknesses Before Attackers Do
A conventional vulnerability scan can identify exposed services and known weaknesses. Authorised penetration testing can go further by validating whether those weaknesses create reachable paths into sensitive digital environments.
Bronyx AI, ITSEC's AI-assisted autonomous penetration testing platform, supports authorised testing of web applications, APIs and defined network environments. It can help security teams assess exposed digital assets, identify vulnerabilities and review potential access paths within an approved scope.
It does not replace vendor governance, financial approval controls or fraud monitoring. Those controls remain essential. Its role is to help organisations understand where technical weaknesses exist and which ones deserve remediation first.
The Arkéa incident offers a useful question for every organisation: if a trusted provider's account were compromised tomorrow, what could an attacker reach, and what could they do once inside?
Explore Bronyx AI at https://bronyx.ai/.
References
-
Reuters, French bank Credit Mutuel Arkea says €100 million missing after cyberattack, 5 November 2026. https://www.reuters.com/legal/government/french-bank-credit-mutuel-arkea-says-100-million-missing-after-cyberattack-2026-11-05/
-
Crédit Mutuel Arkéa, Additional Information Following the Cyberattack on Crédit Mutuel Arkéa, 4 November 2026. https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime
-
Crédit Mutuel Arkéa, Crédit Mutuel Arkéa announces it has been the target of a cyberattack, 4 November 2026. https://www.cm-arkea.com/arkea/banque/assurances/pa_38367/fr/credit-mutuel-arkea-annonce-avoir-ete-victime-d-une-attaque
-
Indian Computer Emergency Response Team (CERT-In), Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor "CRAFTY FALCON", 4 November 2026. https://www.cert-in.org.in/s2cMainServlet?CACODE=CICA-2026-3651&pageid=PUBADV01
-
Reuters, India flags Chinese-linked AI tools in hacking campaign against financial firms, 5 November 2026. https://www.reuters.com/legal/government/india-flags-chinese-linked-ai-tools-hacking-campaign-against-financial-firms-2026-11-05/
-
OWASP Foundation, OWASP API Security Top 10 – 2023, 2023. https://owasp.org/www-project-api-security/
