Crédit Mutuel Arkéa resumes operations after cyberattack, says customer funds unaffected

The disclosure that attackers entered through a service-provider platform puts the incident in the third-party risk category that regulators have flagged repeatedly, and it matters because a bank's perimeter is only as strong as its vendors'. The claim that customer funds were unaffected is the key reassurance, but the bank's own admission that it is still assessing losses leaves the operational and reputational cost unresolved. What is worth watching is whether the vendor route becomes a template for similar disclosures across European banking, and whether the loss assessment forces more detail on scope than has been offered so far.