The biggest bank hacks of the last 30 years: from Citibank to Binance and Crédit Mutuel Arkéa

On 4 November 2026, Crédit Mutuel Arkéa, a French mutual bank, announced that a “sophisticated, external” attack had diverted around €100 million from its own account. Six days earlier, Binance, the world’s largest cryptocurrency exchange, had lost about $6.3 billion in some twenty minutes. Thirty years separate these two cases from the first online bank heist, Citibank in 1994, and yet they tell the same story: nobody attacks the vault any more, they attack the access.

$6.3bn

Source: FBI, 31 October 2026

This article tells the story of the biggest and boldest heists of the last thirty years, period by period, then draws out what applies to any business, bank or not. To understand who the attackers are and what drives them, the chapter Who attacks, and why? of “Cyber A to Z” sets the scene.

What we count, and what we leave out

We are talking about hacking: an intrusion into a computer system belonging to a bank, its customers or its suppliers. Tunnels dug to the vault, traders hiding their positions and purely telephone scams stay out. We do include cryptocurrency platforms, because they now play the role banks played yesterday for thieves: that is where the money is.

Three reading precautions. Amounts are those of the time, in the original currency. “Attempted”, “stolen” and “recovered” are three different figures, and the press often mixes them up. Finally, attributing an attack to a group or a state remains a judgement: we say who makes the claim.

Thirty years in one table

Year	Target	Amount	Flaw exploited	Alleged perpetrator
1994	Citibank (United States)	$10.7m transferred, $400,000 lost	customers’ passwords	Vladimir Levin, Russia
2004	Sumitomo Mitsui, London	£229m attempted, nothing stolen	keyloggers, insider accomplice	British-Belgian gang
2007	Nordea (Sweden)	8m kronor	trojan on customers’ PCs	Russian-speaking network
2008	RBS WorldPay	$9m in 12 hours	44 cloned cards, 2,100 ATMs	Estonian and Russian hackers
2010	US small businesses (Zeus)	$70m	banking trojan, 3,500 mules	Ukrainian network
2013	Bank of Muscat, RAKBANK	$45m in 10 hours	limits removed at a processor	international network
2013-2015	about a hundred banks (Carbanak)	up to $1bn (estimate)	phishing of staff, patience	Eastern European gang
2014	JPMorgan Chase	83 million accounts (data)	server without two-factor authentication	Gery Shalon and associates
2016	Bangladesh Bank	$951m attempted, $81m lost	SWIFT orders from inside the bank	North Korea (DoJ)
2016	Tesco Bank (United Kingdom)	£2.26m in 48 hours	card numbers guessed	not identified
2018	Cosmos Bank (India)	$13.5m in a few hours	12,000 withdrawals in 28 countries	North Korea (UN)
2019	Capital One	106 million people (data)	misconfigured web application firewall	Paige Thompson
2019	Desjardins (Quebec)	9.7 million people (data)	insider, 26 months	an employee
2023	ICBC Financial Services	Treasury settlement blocked	LockBit ransomware	LockBit affiliate
2025	C&M Software (Brazil)	R$813m	credentials sold by an employee	Brazilian network
2025	Bybit	$1.5bn	altered signing interface	North Korea (FBI)
2026	Binance	$6.3bn in 20 minutes	social engineering, hot wallet	North Korea (FBI)
2026	Crédit Mutuel Arkéa	around €100m	a service provider’s platform	investigation ongoing

1994-2007: the pioneers

Citibank, 1994: the first online heist

In the summer of 1994, Citibank’s teams in New York watch transfers leave that nobody ordered. Some forty operations, from $26,800 to $304,000, totalling about $10.7 million, flow out of the cash-management system that large corporate customers use to run their accounts. The orders come from St Petersburg, over a data link, with the credentials of real customers in Argentina, the Bahamas and Indonesia.

Citibank lets it run for a few weeks, with the FBI, to follow the money: the accomplices who withdraw it are arrested in San Francisco, the Netherlands and Israel. The bank will say it recovered everything except about $400,000. Vladimir Levin, a 27-year-old Russian computer specialist, is arrested during a stopover in London in March 1995, extradited in 1997 and sentenced to three years in prison in 1998. How he obtained the passwords was never established.

Flaw exploited: the cash-management system accepted a customer’s plain user ID and password, with no second factor and no check on where the connection came from. Alleged perpetrator: Vladimir Levin, a Russian computer specialist convicted in the United States in 1998, with a network of accomplices handling the withdrawals.

Sumitomo Mitsui, London, 2004: £229 million and a badly filled form

In September 2004, a security supervisor at the London branch of Sumitomo Mitsui lets two Belgian hackers into the offices at night, switching off the cameras. They install keystroke loggers on the workstations, an off-the-shelf parental-monitoring product chosen because antivirus software does not flag it. In October, armed with the captured credentials, they try to wire £229 million to accounts in Spain, Dubai, Hong Kong and Singapore.

Nothing leaves: the SWIFT orders contain errors in one field and are rejected. One Monday, staff find cables unplugged and workstations moved, and the bank calls the police. In March 2009, the mastermind of the account network, Hugh Rodley, gets eight years; the corrupt security guard, four years and four months. The attempt remains one of the biggest ever foiled.

Flaw exploited: physical access to the workstations, opened by a complicit security guard, and keyloggers the antivirus did not flag. Alleged perpetrators: Hugh Rodley, the guard Kevin O’Donoghue and two Belgian hackers, convicted in London in 2009.

Nordea, 2007: the attack moves to the customer

Between September 2006 and January 2007, about 250 customers of the Swedish bank Nordea receive fake emails from their bank inviting them to install an “anti-spam tool”. It is a trojanTrojan (Trojan horse)Malware disguised as a legitimate program or document that secretly opens a way in for the attacker once the victim installs it themselves., a variant of Haxdoor, which activates at login and shows a fake error to make them re-enter their user ID and one-time codes. Nearly 8 million kronor go to money mules, then on to Moscow and St Petersburg. Nordea refunds all its customers. The lesson fits in one sentence: when the bank is too well defended, attack its customers.

Flaw exploited: one-time codes typed by the customer on an infected computer, which passed them to the thieves before the bank. Alleged perpetrator: a Russian-speaking network never identified; only money mules were tried in Sweden.

2008-2013: ATMs spit out cash

RBS WorldPay, 2008: 2,100 ATMs in twelve hours

On 8 November 2008, in under twelve hours, teams of “cashers” empty more than 2,100 ATMs in 280 cities, from the United States to Japan, for more than $9 million. They hold only 44 cloned prepaid payroll cards. The hackers, inside the network of the payment processor RBS WorldPay, had broken the PIN encryption and raised the withdrawal limits on those cards. The Estonian Sergei Tšurikov, who linked the hackers to the street crews, would be sentenced to eleven years in the United States in 2014; the Russian hacker who found the flaw, tried in Russia, received a suspended sentence.

Flaw exploited: a vulnerability in the payment processor’s network, breakable PIN encryption and withdrawal limits that could be changed from inside. Alleged perpetrators: Sergei Tšurikov (Estonia), Viktor Pleshchuk (Russia) and Oleg Covelin (Moldova), indicted in Atlanta in 2009.

Heartland, 2008: 130 million cards through one SQL injection

Heartland Payment Systems is not a bank but a processor handling card payments for hundreds of thousands of merchants. In late 2007, Albert Gonzalez and two Russian accomplices get in through an SQL injectionSQL injectionAn attack that slips database commands into an input field or URL in order to read, change or delete data the attacker should never be able to touch. in a web application, then install software that copies card data in transit. The US Department of Justice would put the haul at 130 million card numbers. Gonzalez, a former US Secret Service informant, is sentenced in 2010 to twenty years in prison.

Flaw exploited: an SQL injection in a web application, then an internal network where card data travelled unencrypted. Alleged perpetrators: Albert Gonzalez (United States), sentenced in 2010, and two Russian accomplices, including Vladimir Drinkman, sentenced in 2018.

Zeus, 2010: $70 million taken from small businesses

The most instructive heist for a small business carries no bank’s name. Between 2009 and 2010, the Zeus banking trojan, spread by phishingPhishingA scam that impersonates a trusted sender (a bank, a supplier, a colleague) by email, text message, phone call or QR code to trick the victim into clicking, handing over credentials or paying., settles on the computers of bookkeepers at small American firms, town halls and parishes. The criminals log in as them and chain transfers, often under $10,000 to avoid attention, to 3,500 mule accounts recruited among foreign students. The tally of the FBI investigation, named Trident Breach: $70 million stolen out of $220 million attempted. One of the organisers, Vyacheslav Penchukov, would only be arrested in 2022, in Geneva, and sentenced to nine years in 2024.

Flaw exploited: bookkeepers’ computers infected by email, and online banking unable to tell the customer from whoever was typing in their place. Alleged perpetrators: a Ukrainian and Russian network, including Vyacheslav Penchukov, with mules recruited in the United States and the United Kingdom.

“Unlimited Operations”, 2013: $45 million with no limit

On 19 February 2013 at 3 p.m., withdrawals begin in 24 countries. When they stop, ten hours later, 36,000 transactions have pulled $40 million out of ATMs, on just twelve prepaid cards from Bank of Muscat, in Oman. Two months earlier, $5 million had been taken the same way from RAKBANK in the Emirates. The hackers had not touched the banks: they had got into the Indian and American processors that managed their prepaid cards, inflated the balances and removed the limits, then distributed card numbers and PINs to casher cells. The New York cell, eight people, is indicted in May 2013; its alleged leader is murdered in the Dominican Republic a few weeks earlier.

Flaw exploited: the systems of two prepaid-card processors, where balances and limits could be changed without the bank seeing it. Alleged perpetrators: an international network never named for the hacking itself; the New York casher cell was indicted in 2013.

2013-2015: Carbanak, the bank itself as the target

Until then, thieves robbed customers or processors. In February 2015, Kaspersky, with Interpol and Europol, describes a campaign of another kind: Carbanak. Since 2013, a multinational gang has been sending booby-trapped emails to bank employees. Once a workstation is infected, the attackers work their way to administrators’ machines (this is lateral movementLateral movementThe techniques an attacker uses to move from a first compromised machine to others on the network, until reaching the real targets.), then wait. For two to four months, they record staff screens and keystrokes to learn internal procedures and imitate employees.

When they know how, they help themselves in three ways: transfers to their own accounts from the bank’s tools; ATMs ordered to dispense cash at a set time, in front of an accomplice; and inflated balances, for instance a $1,000 account raised to $10,000, with the $9,000 difference wired out before the customer notices anything. From $2.5 to $10 million per institution, up to a hundred institutions in some thirty countries, and a total estimated by investigators at a billion dollars, a figure never audited and disputed by other researchers. The alleged leader is arrested in Alicante in March 2018.

Flaw exploited: employees opening booby-trapped attachments, and internal networks where one could move from a workstation to the administrators’ machines without raising an alert. Alleged perpetrators: a gang from Russia, Ukraine and Europe according to Kaspersky; alleged leader “Denis K.”, arrested in Spain in 2018 according to Europol.

2015-2019: North Korea moves in on SWIFT

The first warnings

SWIFT is not a vault: it is the messaging network through which 11,000 banks send each other payment orders. Its messages are trusted because they come from the banks themselves. That is exactly what attackers would exploit: get inside a bank, and send orders in its name. In January 2015, Banco del Austro in Ecuador lost about $12 million this way, a case that only became known in 2016. In late 2015, Vietnam’s TPBank narrowly blocked more than €1 million.

Flaw exploited: SWIFT credentials obtained inside the bank (Ecuador) and a third-party SWIFT connectivity provider (Vietnam). Alleged perpetrator: not officially established; researchers at BAE Systems and Symantec noted similarities with the Bangladesh case.

Bangladesh Bank, February 2016: the heist of the century

On the evening of Thursday 4 February 2016, 35 payment orders leave the account that Bangladesh’s central bank holds at the Federal Reserve Bank of New York. Total requested: about $951 million. The attackers have been inside the bank’s network for months, through targeted phishing according to the US Department of Justice; malware alters the records of the SWIFT terminal to hide the orders, and the printer that normally outputs confirmations breaks down that night. The next day is the start of the weekend in Dhaka; by the time the bank understands, New York is closed.

Thirty orders are held back by the Federal Reserve, puzzled by transfers to private individuals. Five go through, for $101 million. The $20 million meant for a “Shalika Foundation” in Sri Lanka is recovered: the order read “fandation”, and Deutsche Bank, the intermediary, asked the question. The remaining $81 million lands in four accounts at RCBC bank in Manila, opened under false identities, and is withdrawn and laundered through casinos before the stop request arrives, on a public holiday in the Philippines. About $15 to 18 million would be found.

The central bank’s governor resigns on 15 March 2016. RCBC is fined one billion pesos and a branch manager is sent to prison. In May 2016, SWIFT launches its mandatory security programme for members. In September 2018, the US Department of Justice charges a North Korean programmer, Park Jin Hyok, with this attack, the Sony hack of 2014 and WannaCry in 2017; in February 2021 it adds two of his colleagues and puts their attempts at more than $1.3 billion.

Flaw exploited: an internal network reached by phishing, a SWIFT terminal whose records malware could alter, and no alert independent of the printer. Alleged perpetrator: the Lazarus Group, tied to North Korean military intelligence, according to the US charges against Park Jin Hyok (2018).

Smokescreens: Taiwan and Chile

In October 2017, Taiwan’s Far Eastern International Bank sees about $60 million leave for Sri Lanka, Cambodia and the United States while a strain of ransomwareRansomwareMalware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data., Hermes, encrypts its workstations. Researchers at BAE Systems see it as a diversion; almost all of the money is recovered. In May 2018, Banco de Chile suffers the same staging, more brutally: a destructive program wipes the boot sectors of about 9,000 workstations and 500 servers, and while the teams fight the fire, four SWIFT orders carry nearly $10 million to Hong Kong. The bank spoke of attackers from Eastern Europe or Asia; several security firms pointed to North Korea.

Flaw exploited: SWIFT terminals reachable from a compromised office network, and teams absorbed by the diversion. Alleged perpetrator: Lazarus according to BAE Systems for Taiwan; for Chile, attribution is debated between Eastern European groups and North Korea.

Cosmos Bank, 2018: the FASTCash method

On 11 August 2018, in Pune, Cosmos Bank sees nothing unusual: its customers’ withdrawal requests abroad receive an approval. Except that those approvals are not coming from the bank. The attackers have compromised the internal system that authorises card transactions and answer “yes” in the bank’s place, while about 12,000 withdrawals are made in 28 countries with cloned cards. Two days later, $2 million leaves via SWIFT for Hong Kong. Total loss: nearly $13.5 million. US authorities have described this technique under the name FASTCash and attribute it to North Korea, as did a UN panel of experts for the Cosmos case.

Flaw exploited: the internal server that authorises card payments, compromised to answer “yes” in the bank’s place. Alleged perpetrator: North Korea according to a UN panel of experts (2019); Indian police had not confirmed it.

Bank of Valletta, 2019: cut everything in thirty minutes

On 13 February 2019, during the morning reconciliation, Bank of Valletta in Malta discovers €13 million in false payments to the United Kingdom, the United States, the Czech Republic and Hong Kong. Within half an hour, the bank shuts down everything: branches, ATMs, website, app. The whole country finds itself without its biggest bank for a day, but most of the funds are recovered. The US Department of Justice has linked this heist to North Korea; some analysts had pointed to another group, EmpireMonkey.

Flaw exploited: not detailed by the bank; the attackers were able to issue international payments from its systems. Alleged perpetrator: North Korea according to the US Department of Justice (2021); EmpireMonkey, linked to the Cobalt group, according to some analysts.

Data heists: when the loot is not money

Not every intrusion aims at a transfer. Four cases show what can be done with a customer database, and what regulators think of it.

JPMorgan Chase, 2014. Between June and August, hackers roam more than 90 servers of America’s largest bank and copy the contact details of 76 million households and 7 million small businesses. The entry point reported by the press: a stolen employee credential, used on a forgotten server where two-factor authenticationMulti-factor authentication (MFA)A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough. had not been rolled out. The data is not used to empty accounts but to feed a stock-spam machine: the Israeli Gery Shalon and his associates were pushing worthless shares to millions of customers. The Russian hacker they employed, Andrei Tyurin, is sentenced to twelve years in prison in 2021.

Flaw: a server without two-factor authentication. Alleged perpetrators: Gery Shalon, Joshua Aaron, Ziv Orenstein and Andrei Tyurin, indicted in New York.

Tesco Bank, 2016. From Saturday 5 to Monday 7 November, £2.26 million is taken from 8,261 accounts at the British retailer’s bank. No intrusion: the attackers guessed valid card numbers, because the bank issued them in near-consecutive series, and pushed through contactless magnetic-stripe transactions from Brazil, a type of operation Tesco had never meant to allow. The British regulator would note that the on-call team was alerted by email instead of a phone call (21 hours lost) and that the blocking rule was coded with the currency code for the euro instead of the country code for Brazil. Fine: £16.4 million, the first ever imposed by the FCA for a cyber attack.

Flaw: card numbers issued in sequence and an unintended transaction type accepted. Alleged perpetrator: never identified; the transactions came from Brazil.

Capital One, 2019. A former Amazon Web Services engineer exploits a misconfigured web application firewall to obtain a role that opens more than 700 of the bank’s cloud storage buckets: 100 million people in the United States, 6 million in Canada, including 140,000 Social Security numbers. The US banking regulator imposes an $80 million penalty for a cloud migration carried out without a risk assessment; the bank pays $190 million to its customers. The perpetrator, convicted in 2022, is sentenced to probation.

Flaw: a misconfigured web application firewall in the cloud, granting an over-privileged role. Alleged perpetrator: Paige Thompson, convicted in 2022.

Desjardins, 2019. In Quebec, no hacker: a marketing employee copies the data of millions of members for 26 months to unprotected shared folders, then onto USB sticks that nothing prevented him from plugging in. It is the police who alert the cooperative. The final tally from the Office of the Privacy Commissioner of Canada: 9.7 million people, and a damning finding on segmentation, monitoring and a culture of trust without verification. Cost to Desjardins: C$108 million, before the class action.

Flaw: data accessible to an employee who had no need for it, shared folders and USB sticks not blocked. Alleged perpetrator: a marketing employee, dismissed and arrested.

2020-2026: ransomware, suppliers and cryptocurrencies

ICBC Financial Services, 2023: a bank settling by USB stick

On 8 November 2023, the US arm of the world’s largest bank, ICBC, is paralysed by LockBit ransomware. The US Treasury would assess that the attackers got in through a known flaw in an unpatched Citrix appliance. For two days, ICBC cannot settle its US Treasury trades: according to the Financial Times, the bank hands its trade data to BNY Mellon on a USB stick, and its parent has to inject capital to cover about $9 billion of unsettled trades. No money stolen, but a demonstration: ransomware at a single firm can disrupt the most liquid market in the world.

Flaw exploited: CVE-2023-4966, known as “Citrix Bleed”, on an unpatched remote-access appliance, according to the US Treasury. Alleged perpetrator: an affiliate of the LockBit ransomware, which claimed the attack.

Brazil, 2025: the credential sold for R$15,000

On the night of 30 June to 1 July 2025, attackers log in to C&M Software, a provider that connects Brazilian financial institutions to the Pix instant payment system and to their reserve accounts at the central bank. They drain several of them: more than R$813 million, about $140 million, according to the Federal Police’s tally, in more than 400 Pix transfers converted into cryptocurrencies. The entry point has a name: an IT operator at the provider, who sold his credentials for about R$15,000, less than €2,500. Twenty-one people are arrested in October 2025 in Brazil, Spain and Argentina; only R$32 million was frozen. Two months later, another Brazilian provider, Sinqia, suffers a comparable attack, for about R$710 million.

Flaw exploited: the credentials of an operator at the provider, sold and then used to issue orders from the reserve accounts, with no further check. Alleged perpetrators: a Brazilian criminal network, 21 arrests in October 2025; the employee João Nazareno Roque was arrested in July 2025.

Ronin and Bybit: North Korea changes target

After Bangladesh Bank, banks harden access to SWIFT and large fraudulent transfers become rare. North Korean attackers turn to cryptocurrencies, where a transaction is final within minutes. In March 2022, an engineer at the game Axie Infinity opens a fake recruitment file received on LinkedIn; the attackers take control of five of the nine validators of the Ronin network and make off with nearly $620 million. On 21 February 2025, Bybit loses about $1.5 billion in ether: the hackers had compromised the computer of a developer at Safe Wallet, the signing tool the exchange used, and altered the interface so that Bybit’s managers approved, believing they were signing a routine transfer, the handover of control of their wallet. The FBI attributes the attack to North Korea five days later, under the name TraderTraitor. The money is laundered in about ten days.

Flaw exploited: an engineer lured by a fake job offer and too few independent validators (Ronin); a developer’s computer at the signing tool, altered to deceive the signers (Bybit). Alleged perpetrator: North Korea, the TraderTraitor group, according to the US Treasury (2022) and the FBI (2025).

Binance, 29 October 2026: the record

On 29 October 2026, around 8 p.m. UTC, a Binance hot wallet empties across ten different chains, most of it in some twenty minutes: about $6.3 billion according to the exchange, $6.43 billion according to Elliptic. It is the largest theft in history, by any means. Binance first mentions an engineer’s compromised computer, then a months-long plan built on fake job interviews. On 31 October, the FBI attributes the attack to North Korea and asks platforms to block the laundering addresses; about $2.7 to 3 billion is frozen. Binance announces it will cover the loss from its own funds and reopen withdrawals in phases. On 3 November, Pyongyang denies it.

Flaw exploited: according to Binance, an employee approached by fake recruiters, then a hot wallet whose delegation rules were hijacked; the precise cause has not been published. Alleged perpetrator: North Korea, the TraderTraitor group, according to the FBI (31 October 2026).

Crédit Mutuel Arkéa, November 2026: France joins the list

On 2 November 2026, an independent blockchain investigator spots suspicious flows of more than $100 million. On the 4th, Crédit Mutuel Arkéa confirms: an attack, via a service provider’s platform, used one of the bank’s own accounts to wire funds to other institutions, from which they were converted into cryptocurrencies. The order of magnitude acknowledged by the bank: “around €100 million”; no customer account affected, it says, and part of the funds already recovered by 6 November. The Paris prosecutor has handed the investigation to France’s anti-cybercrime office. The case is ongoing, and these are the facts known at the time of publication.

Flaw exploited: the platform of an unnamed service provider, through which orders were issued from one of the bank’s own accounts; the details are not public. Alleged perpetrator: unknown; the bank says it cannot tell whether the attack is French or foreign, and no group has been named.

$2.02bn

Source: Chainalysis, December 2025

What thirty years of heists teach us

Reading these eighteen cases again, seven constants stand out.

1. The first step is almost always human. Booby-trapped emails at Carbanak, Bangladesh Bank and Zeus; fake recruiters at Ronin and Binance; a corrupt security guard in London; credentials sold in Brazil; a dishonest employee at Desjardins. Social engineeringSocial engineeringManipulation techniques that get a person to bypass security themselves: revealing a password, approving a payment, opening a door or installing software. comes before technique.
2. Nobody attacks the system any more, they obtain its keys. Levin had customers’ passwords; the Dhaka hackers, a SWIFT terminal; Bybit’s, the signing interface. The messages sent were genuine.
3. The supplier is the service entrance. RBS WorldPay, the card processors of Oman and the Emirates, C&M, Sinqia, Safe Wallet, Arkéa’s provider: the final target was not the one compromised. That is the principle of the supply chain attackSupply chain attackAn attack that compromises a trusted supplier, service provider or software component in order to reach all of its customers in turn..
4. The money leaves fast, the alert arrives late. Twelve hours at RBS WorldPay, ten hours in Oman, twenty minutes at Binance; on the other side, 21 hours to reach Tesco’s on-call team and a whole weekend in Dhaka. Attackers choose nights, weekends and public holidays.
5. The diversion is part of the plan. Ransomware in Taiwan, a wiper in Chile: the noise keeps defenders busy while the transfers go through.
6. Attackers make mistakes too. “Fandation”, the SWIFT forms in London, the morning reconciliation in Malta: simple, systematic controls saved hundreds of millions.
7. The regulator punishes governance, not bad luck. The fines on Tesco Bank and Capital One, the findings on Desjardins target decisions not taken, alerts ignored, migrations without a risk analysis.

And for a small business?

You are not a bank, but your attackers use the same doors. In France, payment fraud stayed just under €1.2 billion in 2024, and 32% of that amount was obtained by manipulating the victim directly, fake bank adviser or fake supplier first among them, according to the Banque de France: the small-business version of Carbanak is invoice fraud and CEO fraud. The Zeus of 2010 was already targeting small-business bookkeepers, not traders.

Three reflexes follow directly from these stories. Two-factor authentication on every remote access and every administrator account, because JPMorgan fell through a single server that lacked it. A systematic call-back before any unusual transfer, because a question asked by Deutsche Bank saved $20 million. And a regular look at what an attacker sees of you from outside, because the Citrix flaw at ICBC was known and published before it was exploited: that is the purpose of KrakenShield’s non-destructive penetration test, run on your own domains and under your authorisation.

If despite everything the money has gone or the computers are encrypted, the first hours count: our article Ransomware attack: what to do sets them out, and the chapter Anatomy of an attack explains how, from the first email to the final transfer, a heist like those in this article is built.