Third-Party Portal Breach: How a Supplier Path Can Move Your Money

On November 4, 2026, French banking group Crédit Mutuel Arkéa published details on a cyberattack. In its own FAQ-style press release, the bank said attackers used the bank's own account to send funds to other banks, entered through the platform of a service provider (not through its Fortuneo subsidiary as some rumors claimed), and that customer assets were not impacted beyond delayed transfers. The bank did not confirm a precise stolen figure circulating in the press and said it could only validate the order of magnitude, with some funds blocked and recovery work underway.

The short answer for a Portland small business: your risk is not limited to your own Microsoft 365 tenant. Shared supplier portals for payments, payroll, shipping, EHR, bookkeeping, or bank treasury tools can become a path to your money or your data. Inventory those portals, turn on every MFA option they offer, restrict who can approve payments, and watch for unusual transfer behavior.

This is a vendor-risk story, not a "French banks are uniquely soft" story. It pairs with our earlier post on your cybersecurity being only as strong as your weakest vendor.

What the bank stated

From Crédit Mutuel Arkéa's 4 November 2026 additional information release:

• Attackers used the bank's own account for transactions to other banks, possibly then converting value via specialised platforms.
• Customer federation/subsidiary accounts were not the path used; the bank said no financial consequences for customers' assets.
• Entry was through a service provider's platform, reaching the bank directly; Fortuneo was not the entry point despite some press rumors.
• The incident was described as a sophisticated external attack, contained after detection, with temporary suspension of some transactions and near-full resumption after checks.
• On circulating loss figures around €118 million / about $133 million: the bank said it does not confirm that information and can only validate the order of magnitude; some funds blocked; recovery ongoing.
• Phishing awareness was raised as a follow-on risk for customers; that does not by itself mean customer data was stolen.

Primary PDF: Additional Information Following the Cyberattack on Crédit Mutuel Arkéa

What this means in a 20-person company

You probably do not have a European bank treasury stack. You do have:

• Payroll providers and direct-deposit change workflows
• Bill-pay and ACH approval portals
• CPA / bookkeeper remote access
• Shipping and warehouse vendor portals
• Payment processors and merchant dashboards
• Managed service tools and remote monitoring agents
• Industry portals (medical clearinghouses, title plants, permit systems)

Any one of those with a shared login, a reused password, or a weak approval process can move money or leak files without "hacking the office Wi-Fi."

Practical checklist

1. List every portal that can move money or export customer data

Finance and ops should build the list together. Include personal "temporary" logins people created to get work done.

2. Enforce MFA and unique passwords on every portal that supports them

Prefer phishing-resistant methods where available. Kill shared generic logins.

3. Split initiate vs approve

The person who enters a vendor payment should not be the only person who can release it. Dual control stops a lot of fraud even when a portal password leaks.

4. Turn on transfer alerts

Bank SMS/email alerts for new payees and large outbound transfers are cheap insurance. Test that they reach a phone that is not only inside a compromised mailbox.

5. Vendor questionnaires for anyone with privileged access

Ask how they authenticate admins, whether they support SSO, how fast they revoke access when your employee leaves, and whether they were affected by recent incidents. Offboarding still matters: employee offboarding IT checklist.

6. Watch for callback verification on payment-change requests

Payroll diversion and invoice fraud still ride the same rails. Verify bank-detail changes out of band.

7. Segment and monitor privileged remote tools

If a vendor uses a shared remote-access tool into your network, know which machines it can reach.

How PDX IT helps

We help Portland-area businesses map vendor access, harden Microsoft 365 and endpoint controls, and put monitoring around the accounts attackers actually abuse. Office: 8215 SW Tualatin-Sherwood Road Suite 200, Tualatin. Phone 971-331-4871.

Learn more: proactive cybersecurity services, managed services. 90-day opt-out on managed plans.

FAQ

Did attackers empty customer accounts at Crédit Mutuel Arkéa?

The bank said customer assets were not impacted and that attackers used the bank's own account via a service provider platform.

Should I repeat the €118 million figure as fact?

No. The bank said it does not confirm that figure and can only validate the order of magnitude. Prefer the bank's wording.

What is the SMB takeaway if I am not a bank?

Treat supplier portals that can move money or export data as part of your attack surface. MFA, dual approval, and vendor offboarding are the practical controls.

Is this the same as DreamHost or DigiCert incidents?

No. Those are separate supplier incidents with different causes and details. We cover each one on its own.

Want a vendor-portal risk review?

Contact us, call Steve at 971-331-4871, or email sales@pdxittech.com.

This article is general information, not legal, banking, or insurance advice. Rely on the organization's primary statements for incident specifics.