France's Week of Cyberattacks: A $133 Million Bank Heist and a Hack That Tried to Cook the Blood Supply
Bottom Line Up Front: Between November 1 and November 4, 2026, France absorbed two serious cyberattacks. Thieves moved more than 100 million euros out of the cooperative banking group Crédit Mutuel Arkéa and converted it to cryptocurrency, and a separate intrusion drove the temperature settings on plasma cold-storage units at three sites of the national blood service to dangerous levels. Neither attack came through the front door. In both cases, the attackers entered through a third-party service provider. Customer deposits were not taken, and no blood products were lost. However, the two cases together expose the same weakness that American banks, hospitals, and government agencies share: the vendor you trust is now the door the adversary uses.
What Happened at Crédit Mutuel Arkéa, and What Did Not
On Wednesday, November 4, customers of Crédit Mutuel Arkéa, the Brittany-based group that includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, and the online bank Fortuneo, found the mobile app returning error messages and some transfers blocked. Within hours, the bank confirmed that it had suffered a sophisticated external attack enabling fraudulent operations and had suspended certain transactions to stop further movement of funds.
Early social media reports claimed that customer accounts had been emptied. That is false. The bank stated that the attackers used an account belonging to Crédit Mutuel Arkéa itself, not customer accounts, to push transfers to other banks and then convert the money into cryptocurrency. The incident has no financial consequence for customers, the bank says, beyond delayed execution of some transfers. French public broadcaster franceinfo, citing a source close to the case, put the loss at more than 100 million euros.
The story broke in an unusual way. Blockchain investigator ZachXBT reported on November 2 that an unnamed European institution had lost more than 106 million dollars in stablecoins through exchange withdrawals, later raising the figure to 133 million dollars, and named the bank on November 3, before it said anything publicly. The bank has not confirmed the exact amount, but it has described the entry point: the attackers passed through the platform of one of its service providers and reached the bank directly. A judicial investigation is under way.
"The thieves did not break into 1.5 million customer accounts. They broke into one vendor platform, and that was enough to reach the bank's own treasury."
The Attack on France's Blood Supply
Two days earlier, overnight between November 1 and 2, attackers compromised the supervision and control systems of cold-storage units at three regional sites of the Établissement français du sang (EFS), the national blood service. According to the EFS statement reported by the Associated Press, temperature and defrost thresholds were raised to extremely high levels. The units held bags of plasma intended for transfusion and plasma destined for medicine manufacturing.
Monitoring systems caught the anomaly in time. Staff moved or secured the affected products, and the EFS says no blood products were lost and no health consequences were identified. The attack did not hit the EFS network itself; it hit a refrigeration equipment supplier whose system managed the cold rooms. France's national cybersecurity agency ANSSI and the Health Ministry are investigating.
The incident did not come out of nowhere. On October 11, attackers forced refrigeration controllers at hundreds of French supermarkets into defrost mode overnight, spoiling tons of food. ANSSI's CERT-FR issued an alert the next day covering Danfoss and later Copeland and Dixell controllers, many of them legacy devices exposed to the internet with weak credentials. On November 2, a second wave hit supermarkets in seven European countries. The same night, someone turned the same playbook on the blood supply. No group has claimed responsibility, and investigators have not linked the refrigeration campaign to the bank theft.
The Common Thread: Your Vendor Is Your Attack Surface
Strip away the details and the two French cases tell one story. The target was well defended. The target's supplier was not. Practitioners should take four lessons from this week:
Third-party platforms carry first-party risk. The bank's own perimeter held. A provider's platform gave the attackers a path to the bank's treasury account. Every contract with a payment processor, core banking vendor, or cloud provider extends your attack surface.
Operational technology is now a weapon, not just a utility. Refrigeration controllers, building automation, and medical equipment monitors were built to be managed remotely, often over the open internet, by maintenance firms. Attackers understand this better than most boards do.
Speed of disclosure determines how much money comes back. ZachXBT argued that faster reporting to European law enforcement could have frozen tens of millions of dollars before it was laundered through exchanges and privacy coins. Silence is expensive.
Detection saved the blood supply; luck did not. The EFS survived because its temperature alarms worked and someone acted on them within hours. That is a procurement and training decision, not an accident.
"The supermarkets lost food. The blood bank nearly lost plasma. The next target on the same equipment could be a vaccine cold chain or a hospital pharmacy."
An Analyst's View: Why This Matters in Washington, Not Just Paris
The United States runs on the same controllers, the same vendor ecosystems, and the same assumption that a bank's security ends at its own firewall. Copeland is an American company whose controllers sit in major U.S. grocery chains. American hospitals outsource refrigeration and building automation. American banks route payments through third-party platforms every second of the day. Nothing that happened in France this week required a capability that does not already exist on this side of the Atlantic.
For policymakers, the French response is worth studying: the Prime Minister tasked ANSSI with a cross-border investigation within days of the first supermarket attack. For business leaders, the lesson is blunter. If your vendor inventory does not list which suppliers hold remote access to your systems, you do not know your attack surface.
What Decision-Makers Should Do Now
France's week shows that modern attackers do not need to beat your defenses. They need to find the one supplier who never built any. Three steps apply to every organization reading this, in any country:
Map every vendor with remote access to your network, payments, or operational systems. Treat that list as a crown-jewel document.
Pull internet-exposed control interfaces behind authenticated access now. ANSSI's guidance is public and specific.
Rehearse the disclosure decision before the breach. The organizations that recover funds are the ones that call law enforcement within hours, not days.
OGUN Security Research and Strategic Consulting serves intelligence professionals, policymakers, diplomats, academics, and business leaders across the United States, Africa, and Europe with exactly this kind of analysis. OSRS conducts third-party and vendor due diligence investigations, operational technology and supply-chain risk assessments, and incident-readiness planning for organizations that cannot afford to learn these lessons the way France did this week. Contact us at contact@ogunsecurity.com.
Enjoyed this article? Share it with a colleague who manages vendor risk, and subscribe to our email list for weekly intelligence briefs. Stay informed by following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author: Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, a Professor of Cybersecurity, a national security scholar, and a television commentator. He holds a Ph.D. in Homeland Security Policy and Coordination with a concentration in cybersecurity, and his research on terrorism in cyberspace informs OSRS analysis for international decision-makers.
Comments