Supplier path enables major Crédit Mutuel Arkéa cyberheist
Attackers reached the bank through an unnamed service-provider platform and moved institutional funds, making supplier-connected transaction authority the morning’s highest-priority control question.
Security.io Intelligence Desk · Friday, 6 November 2026
Executive consequence
Crédit Mutuel Arkéa says attackers reached the bank through an unnamed service provider’s platform and used the bank’s own account to make fraudulent transfers.
Decision today
Map every supplier identity and platform capable of initiating, approving or routing treasury transactions.
Chainalysis says names, usernames, password hashes and live tokens for all users were exposed. It also reported an on-path password attack, suspected unauthorised access to some KYT accounts and widespread product shutdowns.
Do today
Revoke Chainalysis sessions, rotate API keys and reset passwords through verified channels.
Zyxel’s earlier GS1900 fix did not block the exploit used in a campaign that compromised 996 switches across 48 countries. The activity relied on CVE-2026-107441, not the older CVE-2026-7273 attribution. Enterprises need model-specific 2.90 Patch 3 firmware and a separate compromise assessment.
Do today
Inventory every GS1900 model and record running firmware from the device.
A supplier-side cyber incident altered temperature and defrost settings at cold-storage installations serving three French blood-service sites. Independent alarms and staff intervention prevented loss or health impact.
Do today
Inventory remote access and supplier control paths for cold-storage systems.
CERT-EU says several threat actors are using the open-source ARTEX offensive framework and assesses similar activity against its constituency as highly likely.
Do today
Baseline privileged identity, cloud control-plane and storage access velocity.