Banks spend more on cyber security than almost any other kind of business. Yet this month, attackers took around EUR 100 million from a French bank without breaking into a single customer account. They came in through a supplier.
For businesses in the UAE and GCC that rely on IT support companies, payment platforms and software providers, the case is a reminder that your security is only as strong as the weakest company with a login to your systems.
What happened at Crédit Mutuel Arkéa
Crédit Mutuel Arkéa is a Brittany-based cooperative banking group with more than 5.8 million customers and EUR 211.5 billion in assets. On 4 November it disclosed a cyberattack in which fraudulent transactions were made from one of the bank's own accounts.
According to the bank, the attacker reached its network through a service provider's platform, then used the bank's own account, not customers' accounts, to send money to other banks, where it was converted into cryptocurrency. The bank called it a "sophisticated attack" and ruled out human error on its side. It has not named the provider and has said its online banking subsidiary, Fortuneo, was not the way in.
Reuters reported that around EUR 100 million was stolen. Other reports put the figure at EUR 118 million; the bank has confirmed only the order of magnitude. Customer savings were not affected, although some transfers were delayed while the bank suspended certain transactions. The bank has informed the European Central Bank and French supervisors, and Paris prosecutors have opened an investigation. On 6 November, the president of Crédit Mutuel's national confederation said part of the money had already been recovered, without saying how much.
Exactly how the provider's platform was abused has not been made public, and we will not speculate. What is known is enough to draw useful lessons.
Speed matters as much as prevention
Blockchain investigator ZachXBT flagged a large unauthorised withdrawal on 2 November, a day after it took place and two days before the bank disclosed the attack. He said that around USD 30 million had been laundered by 3 November, money that law enforcement might otherwise have been able to freeze. Whatever the exact figures, the pattern is familiar: in payment fraud, the first hours decide how much can be recovered.
Why suppliers are such an attractive way in
Most businesses give outside companies some form of access: an IT support firm with remote access tools, an accounting or payroll platform linked to the bank, a software vendor that maintains a business system, or an integration partner with an API key. These connections are often:
- Always on. Accounts and remote tools stay active long after the job that needed them is finished.
- Shared. Several of the supplier's staff use the same login, so nobody knows who did what.
- Highly privileged. Support accounts are often given administrator rights "to save time".
- Invisible. The activity looks legitimate because it comes from a trusted partner.
An attacker who compromises the supplier inherits all of that trust. We saw a similar pattern in the Binance theft, where attackers worked their way in through engineers' computers rather than attacking the platform head-on, as covered in our article on how a fake job interview led to a USD 6bn theft.
What UAE and GCC organisations should do now
- List every outside company that can log in. Include IT support providers, software vendors, payment and payroll platforms, cloud integrations and anyone with VPN or remote desktop access. Note what each can reach and who approved it.
- Make supplier access named, limited and temporary. Give each supplier staff member their own account, with multi-factor authentication, only the permissions the job needs, and access that expires when the work is done.
- Watch and record supplier sessions. Use remote access tools that log and, where possible, record sessions on critical systems, and review them.
- Put two people on every payment. Require dual approval for outgoing payments and for any change to payee bank details, and confirm unusual requests through a separate channel such as a known phone number.
- Set limits and alerts on outgoing money. Agree transaction limits with your bank and ask for alerts on large or unusual transfers, especially outside business hours.
- Write security into contracts. Ask suppliers to commit to minimum controls, to notify you of any security incident within a fixed number of hours, and to let you review their access.
- Plan your first hour. Know who calls the bank, who disables supplier access and who contacts the authorities if money leaves your account unexpectedly. Rehearse it.
Trust, but check the access
Suppliers are essential, and most take security seriously. But every outside login is a door into your business, and an attacker only needs one of them to be weak. Knowing who holds those keys, limiting what they open and watching how they are used is the practical way to keep a supplier's problem from becoming yours.
COMMPRO Technologies supplies identity, privileged access and secure remote access solutions from leading vendors across the UAE and GCC. If you would like help reviewing who outside your organisation can reach your systems, contact our team.
