French cooperative bank Crédit Mutuel Arkéa has reported a cyberattack that enabled fraudulent transactions of up to $133 million, with systems suspended as the bank works to contain and investigate the incident. The attack was carried out via a third-party service provider.
That routing matters. The bank's own perimeter was not the entry point - a supplier with access to its systems was. This is a consistent pattern across financial sector incidents: direct defences improve, so attackers move to the supply chain. A provider that can initiate, approve, or influence transactions on your behalf carries real financial risk, not just reputational or data risk.
The practical question for any organisation using third-party providers with privileged system access is whether those suppliers have ever been subject to formal security assurance - penetration testing, security review, contractual controls - or whether access was granted and then largely forgotten. Third-party risk assessments and supplier access reviews are not a compliance formality. At $133 million, they are clearly a financial controls question.