In early November 2026, a French cooperative bank told the public that attackers reached the group through a service provider, then used the bank’s own account to send money to other banks. Customer accounts, the bank said, were not debited. Some transfers were delayed while teams locked things down. The exact total taken is still a number the bank will only describe as “the order of magnitude” of a much larger figure circulating in the press.
You do not need a European balance sheet for this story to matter. You need one vendor that can instruct a payment, push a file into a clearing system, open a remote session into the finance VLAN, or approve a change that looks like it came from you.
That is common in small professional firms. Bookkeeping platforms, payment processors, payroll providers, EHR billing modules, trust-account interfaces, and “temporary” support connections all sit next to money movement. When something goes wrong, the press release often names the company customers recognize, while the door was one hop away.
What the bank actually said
Stick to the primary source. The bank’s own FAQ and follow-up notice said:
- Attackers used the bank’s own account to carry out transactions to other banks, which may then have been converted through specialized platforms.
- Customer accounts of its federations and subsidiaries were not the path, and the bank says there were no financial consequences for customers.
- Press reports that blamed a particular subsidiary as the entry point were wrong, according to the bank. The path was a service provider platform that reached the group directly.
- The bank rejected the idea that a simple internal click caused it, and said security systems spotted suspicious activity quickly.
- On the headline figure reported elsewhere, the bank would not confirm the exact amount and would only validate the order of magnitude while recovery work continued.
That last point matters for how you talk about incidents inside your own firm. “Order of magnitude” is not a rounding error. It is a company saying the chatter is in the right neighborhood while accounting and recovery are still open. If you ever have to write a notice, say what you know, what you do not know, and what customers should do. Do not invent precision you do not have.
The architectural sentence that should worry non-banks
The interesting line is not the denial about a subsidiary. It is that attackers used the group’s own account.
Customer deposits were not the pivot. A privileged origination path was. If you run treasury, trust accounting, medical billing remittance, or any process where a third party can create a payment that looks legitimate downstream, that sentence should sound familiar.
Most small firms never draw the diagram. They buy a tool, grant it API keys or a service account, leave a standing ACH approval in place, or let a vendor keep a support tunnel “just in case.” The org chart says the money lives with you. The access graph says a contractor can move it.
A checklist disguised as someone else’s press release
Translate the bank FAQ into questions your office can answer this week.
Which third parties can originate or approve movements that look like they came from you? List payment processors, payroll, bill-pay portals, banking APIs, RPA bots, and any MSP or software vendor with a standing remote session into finance systems. If the list is longer than you expected, that is the finding.
If one of those parties is abused, do you notice in minutes? Or do you find out when a blockchain investigator posts screenshots, a bank calls, or a client asks why a wire went somewhere new? Alerting on unusual destinations, new payees, and out-of-hours releases is not only for banks.
Can you freeze outbound rails without freezing every client payment for a morning? If the only “kill switch” is turning off the whole billing system, write down which delays you will accept before you need that decision under pressure.
When you warn clients about phishing after an incident, are you notifying them of a data loss or of copycats? Say which one, out loud. After high-profile heists, fake “recovery” and “verify your account” calls spike. Tell people which channels you will use, and which you will never use to ask for passwords or codes.
What “aligned with” looks like for a small firm
For medical, legal, and finance offices, this is not an abstract vendor-management essay. It maps to work you already owe:
- Unique accounts and least privilege for every vendor identity, not a shared “support” login.
- MFA on every admin and finance path, preferably phishing-resistant for people who can move money.
- Logging that shows who approved a payee change and from where.
- An offboarding rule that cuts vendor access the same day a contract ends.
- A short tabletop: “our payroll vendor is abused on a Friday afternoon; what do we freeze first?”
Dark Edge Consulting builds managed security programs where vendor access is treated like any other privileged identity. We help you inventory who can instruct payments, put continuous monitoring and alerting on the paths that matter, and keep evidence that stands up when an insurer, examiner, or partner asks how you control third parties.
We never audit systems we manage. When you need an independent look, we help you scope it and bring in a separate assessor. For day-to-day control of the people and tools that can move money, that separation is a feature, not a gap.
What to do this month
- Make the vendor-and-payment list. Name the product, the access path, and the human owner inside your firm.
- Kill standing support tunnels that have not been used in 90 days.
- Require dual control for new payees and for changes above a threshold you choose.
- Review the last 30 days of outbound payments for destinations nobody recognizes.
- Put the freeze playbook on one page and store it where finance and IT can both find it.
You probably will never write a notice with nine-figure language. You can still lose a week of cash flow, a trust account balance, or a client relationship because a service provider hop looked like a normal payment. Close the hop you can see. Monitor the ones you have to keep.
Adapted from a post by Andrew Trainum on Cybersecsloth.
—
Want a second set of eyes on which vendors can touch your money movement? Book a strategy call.