French bank suffers cyberattack with losses estimated at €118 million

French regional lender Crédit Mutuel Arkéa has confirmed it was the victim of a sophisticated cyberattack that resulted in fraudulent transfers and estimated losses of €118 million, making it one of the most significant cyber incidents to impact the European banking sector this year.

According to the bank, attackers gained access to Arkéa-controlled accounts and initiated unauthorised transfers to external financial institutions. The stolen funds were subsequently converted into cryptocurrencies through specialised exchange platforms in an apparent attempt to obscure their movement and complicate recovery efforts. The bank stressed that customer accounts were not compromised and that clients will not suffer any financial losses as a result of the incident.

Crédit Mutuel Arkéa described the attack as an external and highly sophisticated operation, ruling out human error as the cause. While some of the transferred funds have reportedly been frozen, recovery efforts remain ongoing. French authorities have launched a formal investigation to determine how the breach occurred and identify those responsible.

The incident highlights the continued threat facing financial institutions, as cybercriminals increasingly target banking infrastructure and leverage cryptocurrency ecosystems to move and launder stolen funds. Despite the scale of the losses, Arkéa stated that the attack does not threaten the group's financial stability or ongoing operations.

Cyberattack targets French blood storage systems through refrigeration supplier

France’s national blood service, Établissement français du sang (EFS), has confirmed that a cyberattack affecting one of its refrigeration equipment providers caused temperature and defrost settings to be altered at three blood storage facilities. The incident raised concerns over the safety of blood products and biological samples stored within the affected cold-storage systems.

According to EFS, the organisation was not directly targeted. Instead, attackers compromised a supplier’s remote monitoring platform used to manage refrigeration equipment. The intrusion resulted in temperature thresholds being increased to unusually high levels, potentially jeopardising blood products destined for hospitals and medical facilities.

EFS said its monitoring and alarm systems detected the changes quickly, enabling staff to intervene, repair affected equipment and transfer products to alternative storage locations where necessary. The organisation confirmed that no blood products were lost, no health impacts were identified, and blood collection and distribution services continued without disruption.

The incident comes amid a growing wave of cyberattacks targeting refrigeration and operational technology (OT) systems across Europe. Recent attacks have disrupted supermarket refrigeration infrastructure in France, Belgium, the Netherlands and other countries, highlighting the increasing cybersecurity risks facing connected industrial and critical healthcare systems. EFS is now working with France’s national cybersecurity agency and health authorities to strengthen monitoring and enhance protections against similar attacks.

North Korean job interview scam linked to $6.3 billion Binance hack

Cryptocurrency exchange Binance has revealed that the cyberattack behind the theft of $6.3 billion in digital assets began with a sophisticated social engineering campaign targeting one of its employees. According to the company's investigation, attackers believed to be linked to North Korea's notorious Lazarus Group posed as recruiters and lured a Binance software engineer into a fake job interview process.

The employee was contacted through a legitimate recruitment platform and participated in multiple interviews before being asked to complete a coding assignment. The assignment contained previously unseen malware designed to evade security controls and establish access to the engineer's device. Attackers subsequently used the compromised system to gain credentials, move laterally within Binance's environment and access wallet management infrastructure.

On October 29, the threat actors allegedly leveraged stolen credentials to deploy malicious code and authorise fraudulent cryptocurrency transfers across multiple blockchains. Binance said it has since rebuilt affected systems, revoked compromised credentials and worked with industry partners to freeze or recover a significant portion of the stolen assets.

The incident highlights the growing effectiveness of recruitment-themed cyberattacks, particularly against technology and cryptocurrency firms, where highly targeted social engineering remains one of the most successful methods for gaining initial access to corporate networks.

SonicWall warns of unpatched vulnerabilities in end-of-life management platform

SonicWall has warned customers of two newly disclosed security vulnerabilities affecting its Global Management System (GMS) platform, stressing that no security updates will be released because the product has officially reached end-of-life status.

The flaws, tracked as CVE-2026-109593 and CVE-2026-109594, impact GMS version 9.5.2 and earlier. One vulnerability could allow unauthenticated attackers to access sensitive information by reading internal system files, while the second exposes affected systems to SQL injection attacks that could enable unauthorized access to or modification of data stored within the GMS database.

SonicWall has advised organisations still using GMS to migrate to its replacement platform, Network Security Manager (NSM), as the vulnerabilities will remain permanently unpatched. The warning is particularly significant given the growing focus of cybercriminals on SonicWall products, which have been repeatedly targeted in zero-day attacks and ransomware campaigns in recent years.

Security experts caution that unsupported management platforms present a growing risk to organisations, especially when they control large numbers of security appliances and network devices. The disclosure serves as a reminder of the importance of retiring end-of-life technology and maintaining up-to-date security management infrastructure to reduce exposure to emerging threats.

Bristol Schools Cyberattack Data Published on the Dark Web

More than 320,000 files stolen during a cyberattack on Bristol City Council’s school services platform have been discovered on the dark web, raising concerns for schools, staff, parents and pupils across the city. The data originates from the council’s Trading with Schools platform, which was compromised in September and is used by dozens of local schools to manage administrative and educational functions.

According to the council, 39 schools that relied on the platform for services beyond internet connectivity were affected. The system is used to manage a range of sensitive information, including staff records, payroll data, lesson planning, scheduling and, in some cases, educational psychology files relating to children.

Officials are currently analysing the leaked data to determine exactly what information has been exposed and who may be affected. School leaders have been notified and are providing guidance to impacted families and staff. The South West Regional Organised Crime Unit is investigating the incident.

The breach highlights the growing threat facing the education sector, where cybercriminals increasingly target schools and local authorities due to the large volumes of sensitive personal information they hold. Authorities are urging affected individuals to remain vigilant for phishing attempts, fraud and other forms of identity-related cybercrime.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.