Third-party risk after a provider-led bank heist: what to check in your vendors this week
Quick answer, Nov 9, 2026As of 9 November 2026, Crédit Mutuel Arkéa says attackers reached it through the platform of an unnamed service provider and moved money out of the bank's own account. The checks that address that pattern are already written down: NIST CSF 2.0 GV.SC-04 to GV.SC-08 and SP 800-161r1 AC-20.
What the reports say, and what they do not
Crédit Mutuel Arkéa issued a statement on 4 November 2026 confirming it had been the victim "of an attack that enabled fraudulent transactions to be carried out", and said in a follow-up FAQ that the attackers reached the bank's network "via the platform of a service provider" (Infosecurity Magazine, 9 November 2026). The bank is quoted there saying they "used Crédit Mutuel Arkéa's own account to make transactions to other banking institutions" and "did not, therefore, use customer accounts belonging to its federations or subsidiaries."
Help Net Security reports the bank declined to confirm the €118 million ($133 million) traced on-chain, saying it could "simply validate the order of magnitude", and did not name the provider.
So the provider is unnamed, the method sits with judicial and police authorities, and the final amount is too early to state. The rest is UNKNOWN. What is usable now is the shape: a provider's platform, not a customer's credentials, was the route in.
Six checks to run this week
| Check | What to ask for | Where it is written |
|---|---|---|
| 1. The list | Every provider whose platform can reach your systems or initiate a transaction, ranked by what it can do rather than by what you spend | NIST CSF 2.0, GV.SC-04: "Suppliers are known and prioritized by criticality" |
| 2. The access | What each provider's platform is authorized to do on your side, who monitors that access, and whether the agreement says so | NIST SP 800-161r1-upd1, Appendix A, AC-20 "Use of External Systems" |
| 3. The attestation | A current third-party certification, or written answers where there is none | CISA Vendor SCRM Template, question 4.1 |
| 4. The provider's own remote access | How the provider manages remote access for its employees and its suppliers, "including deactivation of accounts" | CISA Vendor SCRM Template, question 4.15.2.1 |
| 5. The notification clause | When and how the provider tells you about a breach, in the contract rather than the sales deck | NIST CSF 2.0, GV.SC-05; Interagency Guidance, IV.C.3.h |
| 6. The incident plan | The provider named in your own response plan, with contacts and a rule for what you may share mid-incident | NIST CSF 2.0, GV.SC-08; SP 800-161r1-upd1, IR-4(10) |
Start with what the platform can do
A vendor questionnaire ranks suppliers by how well they answer questions. This pattern ranks them by what their platform is permitted to do inside your environment. Those are different lists, and the second one is shorter.
NIST SP 800-161r1-upd1, Appendix A, AC-20 "Use of External Systems" makes the distinction: unlike an internal enterprise, where "direct and continuous monitoring is possible", information in a supplier relationship "may be shared on an as-needed basis and should be articulated in an agreement", and "access to the supply chain from such external information systems should be monitored and audited." The same control says to flow the requirement down to sub-tier contractors.
Write down, per provider: which systems the platform touches, whether it can initiate or alter a payment instruction, which of your logs would show it doing so, and who reads those logs. CSF 2.0 GV.SC-04 asks only that suppliers be "known and prioritized by criticality". That ranking is the deliverable.
Put the notification clause in the contract
CSF 2.0 GV.SC-05 asks that cybersecurity requirements "are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties." The federal banking agencies are more specific. The Interagency Guidance on Third-Party Relationships: Risk Management (88 FR 37920, 9 June 2023), section IV.C.3.h "Confidentiality and Integrity", says "another important provision is one that specifies when and how the third party will disclose, in a timely manner, information security breaches or unauthorized intrusions."
Two neighboring sections carry the rest. Section IV.C.3.d "The Right To Audit and Require Remediation" says to consider "the types and frequency of audit reports" you are entitled to receive. Section IV.C.4 "Ongoing Monitoring" names what you watch for: "security breaches, data loss, service interruptions, compliance lapses, or other indicators of increased risk."
Name the provider in your own plan
CSF 2.0 GV.SC-08 asks that "relevant suppliers and other third parties are included in incident planning, response, and recovery activities." SP 800-161r1-upd1, Appendix A, IR-4(10) "Incident Handling | Supply Chain Coordination" adds the awkward part: where "transparency for incident handling is limited due to the nature of the relationship, define a set of acceptable criteria in the agreement (e.g., contract)." Settle now what you may tell a provider while you are still containing an incident, and what it owes you.
Answers age. SR-6 "Supplier Assessments and Reviews", in the same appendix, asks that assessments run "against a consistent set of core baseline factors and assessment criteria to facilitate equitable comparison (between suppliers and over time)". GV.SC-10 covers what applies after a service agreement ends.
Reading the record from an AI assistant
The Distributed Risk MCP server covers the official-record part of a vendor review: search_screening_lists to screen the provider, its owners and any named subcontractor; search_kev and list_ai_stack_vulnerabilities for known-exploited flaws in the software it runs; list_cyber_advisories for CISA advisories naming it; list_cyber_incident_filings for SEC Item 1.05 disclosures on EDGAR. The underwriting view of a KEV listing is in What a cyber underwriter checks when CISA adds a KEV listing, and the screening method in How to screen a counterparty against OFAC lists.
If a provider's compromise has already reached you, the sequence is in First 72 hours after ransomware. Where the review needs ownership, origin or in-country work on a provider, brief an advisor and we arrange a partner firm that works there.
Questions
Is a SOC 2 Type 2 report enough? It answers question 4.1 of the CISA template and closes that section. It does not tell you what the provider's platform is authorized to do inside your systems, which is check 2 and the one this incident turns on.
We are not a bank. Does the Interagency Guidance apply? No. It applies to the banking organizations the Board, FDIC and OCC supervise. Read section IV.C.3 anyway: it is the most detailed public list of third-party contract provisions a US regulator has published.
Is this legal advice? No. This page is a procedural checklist drawn from the public record. Counsel decides what your contracts and your regulator require.