A cyberattack against Crédit Mutuel Arkéa, headquartered near Brest, is reported to have diverted around 118 million euros. The banking group acknowledges that the hackers accessed the platform of an external service provider. This incident raises questions about the security of IT outsourcing, well beyond the banking sector.
The most concerning aspect of this case may not be the amount embezzled, but the fact that the hackers were able to penetrate the banking systems through an external service provider. The exact circumstances of the attack remain to be established.
The author of this article was one of three webmasters at a large American bank in San Francisco. The servers were hosted and managed by the bank itself. The transactional systems and their security were handled by an internal team of IT professionals. The use of external IT service providers was strictly prohibited.
This case takes on an additional dimension with the arrival of artificial intelligence agents. An AI used remotely, on the servers of an American or Chinese provider, also constitutes an external IT service. When it has access to a company's data or systems, AI introduces an additional dependency and new risks. The alternative exists: download open-source LLM models and run them on one's own servers, in order to maintain control over data, permissions, and operations.
The Arkéa case serves as a reminder of a fundamental principle of cybersecurity: the more stakeholders and access points to sensitive systems are multiplied, the more difficult their control becomes.
