A French bank lost up to $133 million. The way in was a service provider.

Crédit Mutuel Arkéa disclosed a cyberattack on 4 November. The attacker reached its network through a service provider's platform and used the bank's own account to move funds into USDC and USDT. Investigator ZachXBT estimates up to 118 million euros (about $133 million); the bank only validates the order of magnitude, per BleepingComputer.

Your vendor's login screen is part of your perimeter. Here it led straight to the account that moves the company's own money, not a customer's. Nobody's password reset would have stopped that.

List every vendor platform with a path into your network or payment systems today. For each one, confirm MFA, the narrowest access possible, and an alert on new outbound transfers.