--- title: The Crédit Mutuel Arkéa cyberattack reinforces the need to control suppliers and transactions description: Crédit Mutuel Arkéa's cyberattack highlights the critical need for robust supplier controls and security measures in financial organizations. image: https://blog.isecauditors.com/hubfs/descubrimiento-de-datos.png --- English - [Spanish](https://blog.isecauditors.com/el-ciberataque-a-credit-mutuel-arkea-refuerza-la-necesidad-de-controlar-proveedores-y-transacciones) - [English](https://blog.isecauditors.com/en/the-credit-mutuel-arkea-cyberattack-reinforces-the-need-to-control-suppliers-and-transactions) [![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png) ![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png)](https://blog.isecauditors.com/?hsLang=en) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) [Security Audits](https://blog.isecauditors.com/en/tag/security-audits) [DORA Implementation](https://blog.isecauditors.com/en/tag/dora-implementation) [Computer Forensics](https://blog.isecauditors.com/en/tag/computer-forensics) # The Crédit Mutuel Arkéa cyberattack reinforces the need to control suppliers and transactions [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) Nov 5, 2026, 3:07:35 PM Madrid, 5 November 2026. Crédit Mutuel Arkéa announced on 4 November that a cyberattack had enabled fraudulent transactions. The bank says the incident is contained and customer assets are unaffected, although some transfers were delayed. It temporarily suspended certain transactions and resumed operations after checks and enhanced security measures. \[1\] In its subsequent clarification, the group identifies a supplier’s platform as the entry point, rather than Fortuneo, and says an Arkéa-owned account was used to transfer funds to other banks, potentially enabling later conversion into cryptocurrency. It does not confirm the reported €118 million figure, while acknowledging the order of magnitude; some funds were blocked. The final amount remains under assessment. It does not publicly identify the supplier or specific vulnerability. \[2\] The bank also gives a precautionary warning about impersonation attempts aimed at obtaining confidential information. At Internet Security Auditors, we recommend verifying messages through established banking channels and not disclosing passwords or validation codes to anyone requesting them. This caution should be supported by internal procedures to recognise, escalate and communicate fraud indicators without relying on a single person or channel. \[1\] For financial organisations, we propose reviewing third-party access and transaction authorisation together: dedicated identities, least privilege, operational limits, segregation of duties and risk-based approval controls. Detection should correlate technical activity with financial movements and reconciliations. Crisis exercises should verify the ability to suspend specific operations, preserve logs and coordinate recovery with suppliers and receiving institutions. Internet Security Auditors supports these priorities through DORA gap assessments and action plans, technical audits, and access and integration reviews, alongside business continuity and disaster recovery plans. We complement prevention with digital forensics and incident response to establish scope and preserve evidence. The aim is to translate supplier dependencies and fraud scenarios into verifiable controls and workable response procedures. \[3-6\] ![resilience-against-baking-fraud](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/resilience-against-baking-fraud.png?width=900&height=307&name=resilience-against-baking-fraud.png) Referencias \[1\] Crédit Mutuel Arkéa — Initial statement dated 4 November 2026 [https://www.cm-arkea.com/arkea/banque/assurances/pa\_38367/fr/credit-mutuel-arkea-annonce-avoir-ete-victime-d-une-attaque](https://www.cm-arkea.com/arkea/banque/assurances/pa_38367/fr/credit-mutuel-arkea-annonce-avoir-ete-victime-d-une-attaque) \[2\] Crédit Mutuel Arkéa — Clarifications on access, accounts and amounts [https://www.cm-arkea.com/arkea/banque/assurances/pa\_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime](https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime) \[3\] Internet Security Auditors — DORA compliance services [https://www.isecauditors.com/en/pages/dora-implementation](https://www.isecauditors.com/en/pages/dora-implementation) \[4\] Internet Security Auditors — Technical security audits [https://www.isecauditors.com/en/pages/technical-security-audit](https://www.isecauditors.com/en/pages/technical-security-audit) \[5\] Internet Security Auditors — Business continuity and disaster recovery [https://www.isecauditors.com/en/pages/continuity-resilience-secure-development](https://www.isecauditors.com/en/pages/continuity-resilience-secure-development) \[6\] Internet Security Auditors — Digital forensics and incident response [https://www.isecauditors.com/en/pages/digital-forensics-and-expert-witness-services](https://www.isecauditors.com/en/pages/digital-forensics-and-expert-witness-services) - [Tweet](https://twitter.com/share) --- ![author-image](https://blog.isecauditors.com/hubfs/Logo_isecauditors_contraccion_HP.png) [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) PCI SSA, PCI QSA, CISSP, CSSLP, ISO 27001 L.A., CSFPC, SFPC Security Consultant Consulting Department --- [Legal Notice](https://www.isecauditors.com/aviso-legal) [Policy Privacy](https://www.isecauditors.com/politica-privacidad) [Cookie Policy](https://www.isecauditors.com/politica-cookies) --- Copyright © 2026 - All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alberto Villar Arévalo", "url" : "https://blog.isecauditors.com/en/author/alberto-villar" }, "dateModified" : "2026-11-05T14:07:35.003Z", "datePublished" : "2026-11-05T14:07:35.000Z", "headline" : "The Crédit Mutuel Arkéa cyberattack reinforces the need to control suppliers and transactions", "image" : [ "https://blog.isecauditors.com/hubfs/descubrimiento-de-datos.png" ], "mainEntityOfPage" : { "@id" : "https://blog.isecauditors.com/en/the-credit-mutuel-arkea-cyberattack-reinforces-the-need-to-control-suppliers-and-transactions", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.isecauditors.com/hubfs/isec_logo.png" }, "name" : "Internet Security Auditors, S.L." } } ```