Traditional banks have suffered a series of attacks in recent months: France's Arkéa may have lost over $133 million, while most other incidents involved data breaches.

November 4: Today, French mutual credit group Crédit Mutuel Arkéa's online bank Fortuneo confirmed that it suffered a fraudulent cyberattack on November 1, and the scale may be far greater than the approximately $133 million previously monitored by third parties. The fraudsters were able to initiate transfers from Fortuneo and set the recipient names themselves, equivalent to being able to send funds to any account worldwide under a name of their choosing. Sources close to the hacker community lean more toward an internal human vulnerability rather than a long-term stealth intrusion into the payment system. Some analysts believe this attack may be a variant of "CEO fraud" carried out by French-speaking cyber actors, namely impersonating executives to induce employees to cooperate.

For more than a month, multiple traditional banks and financial institutions in South Korea, India, Latin America, and Europe and the United States have successively exposed cyberattacks. Most are still leaks of customer or employee data, and core transaction systems often have not been directly breached. Cases like France's Crédit Mutuel Arkéa, where funds were stolen and transferred into cryptocurrency channels, remain a minority.

A wave of attacks on financial institutions broke out in South Korea from the end of September to October. About 16 institutions, including Shinhan, KB Kookmin, Hana, Busan Bank, savings banks, and Hyundai Capital, were hit, with about 100,000 pieces of personal information leaked, including names, phone numbers, income, and loan limits, with some including ID numbers. The attacks did not enter core transaction systems, but instead entered through side doors such as loan intermediary inquiries and employee office systems. CrowdStrike said the perpetrators are suspected to be individual Chinese-speaking hackers using the AI penetration tool ARTEX and calling large models such as Claude and DeepSeek. South Korean regulators said no customer funds have been stolen so far.

In August, New York State's Sawyer Savings Bank temporarily closed branches for about a week due to a suspected vendor vulnerability, saying no customer accounts were directly harmed or data maliciously used. In early September, Wyoming's Hilltop Bank in the United States temporarily closed branches and interrupted online and mobile banking due to a cybersecurity incident, saying this was to isolate the environment and protect customer data. The bank ultimately said no customer assets or data were stolen.

In mid-October, India's State Bank of India (SBI) confirmed that personal records of about 3,897 customers appeared on the dark web, including names, mobile numbers, dates of birth, addresses, and loan records. Preliminary analysis said the scale of related dark web records was about 375,000. SBI has notified each one and said customer funds are safe.

In late October, more than 400 banks and payment institutions in Latin America suffered attacks. Security company Straiker said the criminal group CyberCartel used multiple models including Claude, Grok, and Kimi to form an automated attack system CARLIY0S, targeting more than 400 financial targets in Latin America. On September 24, a snapshot of its stash contained about 4,493 records, including credentials, API keys, and account information.