decrypted · 9 november 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

A bank's own account was emptied through a supplier's platform

Nothing that broke this afternoon has overtaken the stories already told today, so this bulletin takes one Decrypted has not covered: a French bank that lost a sum reported at about €118 million without a single customer account being touched. Crédit Mutuel Arkéa said on Wednesday that attackers had reached an internal account through a service provider's platform.

What happened

The Record and BleepingComputer both report that the blockchain investigator ZachXBT flagged a large theft on Monday 2 November, then named Arkéa as the likely victim. The bank confirmed that attackers had gone through the platform of one of its service providers and used the bank's own account to send money to other institutions. ZachXBT says the money left as cryptocurrency, and puts the loss at up to €118 million. The bank would not confirm that figure and said only that it could validate the order of magnitude. The supplier is unnamed and the amount unconfirmed.

The loading bay

Think of a bank as a building with a strong front door and a loading bay for contractors. Customers' money sat behind the front door, and it stayed shut. The attackers came in through the loading bay: a supplier's platform trusted to act for the bank. As far as the systems could tell, they were the bank, sending payments from the bank's own account.

The bank called the attack sophisticated and ruled out human error. It has not said how long the attackers were active or how many transfers they made, so we cannot judge what monitoring noticed. What a defender sees in a case like this is ordinary payments from an ordinary account. Only the context is wrong.

The design question

Secure by Design asks which decision would have limited the damage. The useful question is not whether the supplier was protected well enough, which you do not control. It is what its access could do if fully compromised.

Controls that answer it are dull and effective:

Per-transfer and daily limits on any account a third party can reach.
A second approval, from a named person inside your organisation, above a set amount.
Payments allowed only to a known list of destinations, with an alert on every first-time beneficiary.

The bank says some funds are frozen and recovery is under way. The design half is making the first transfer hard.

What UK organisations should ask

Put three questions to your finance and IT leads this week. Which suppliers can move money, or change payee details, on your behalf? What is the largest sum they could move before a human at your end is asked to agree? And how quickly must they tell you if their platform is breached? The cost of applying this is mostly configuration and a few awkward contract conversations, not new technology. Arkéa says the loss does not threaten its stability. Most firms could not say the same.

Also this week

OpenSSH, a login bypass. CVE-2026-123158, nicknamed SSHole, is tracked under that public reference number and scores 8.1 out of 10 on CVSS 3.1, the severity score. Per Brandefense's summary of the advisories, it affects Linux systems using musl libc without the pluggable login framework, including default Alpine builds, where an over-long password can get into accounts that have no usable password. OpenSSH 10.6p2 fixed it on 5 November. Update and restart sshd, or switch password logins off. Common glibc setups and Synology's DSM are reported as unaffected, but check embedded kit and containers built on Alpine, where nobody remembers installing an SSH server. Exploitation evidence conflicts: honeypots saw probing, but it is not on CISA's known-exploited list, and probing is not compromise.

Chainalysis, a disclosure that kept growing. The firm first said it had found no evidence that credentials or session tokens were affected. Its 4 November update said names, usernames, password hashes and live tokens for all users were exposed. It describes the attackers' methods as "offensive agentic techniques", its own phrase, and has not said how they got in. It says it has no evidence that investigations data was accessed, and that the incident is unrelated to the Binance theft. Users must reset passwords and rotate API keys, the credentials programs use to talk to the service. A first "no evidence" statement is a hypothesis, not a finding.

NCSC, the annual review. The National Cyber Security Centre's State of the Cyber Nation report, published on 3 November, says AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028. Richard Horne's prepared remarks say the risk is old weaknesses found at scale, not new attacks, and that the UK has "got away with doing tech on the cheap". His list of choices includes not connecting technology to the internet unnecessarily and treating Cyber Essentials as a starting point. The government pairs it with £60 million for a Cyber Shield and £70 million for a vulnerability centre.

Sources

If you want a second pair of eyes on what your suppliers can do in your name, get in touch.