A Collapse, a Heist and a Hacked Safety Net: Sorting Out a Week of Bank Shocks

1. Count what broke, not the banks

The tally doing the rounds online, 130 banks hit in a week, is arithmetic rather than analysis: one Paraguayan bank, 128 Japanese shinkin banks and France's Crédit Mutuel Arkéa. It puts a bank failure, a hardware fault and a theft on one scale, while the breach that matters most, at Brazil's deposit insurer, does not even count. For customers, the question is what broke: money, access or data.

Sorted that way, the week shrinks. Only in Paraguay were savers locked out of their savings for days, and only there do some stand to lose money above the guarantee. The roughly €100m taken from Arkéa came out of the bank's own account; it says clients lose nothing. In Japan, counters and ATMs at 128 shinkin banks were down from about 1.30 pm to just after 7 pm on 6 November: an equipment fault, not a cyberattack, said the operators. That evening Pix, Brazil's instant-payment system, failed for some users.

2. Paraguay: the guarantee pays, the politics breaks

Paraguay is the week's only real solvency failure, and its deposit guarantee is doing its job. Regulators seized ueno bank on 3 November, after the central bank (BCP) put its solvency ratio at about 5.56%, against 12% required. The digital bank held the funds of 2.9 million clients, nearly half the population. The guarantee covers 75 monthly minimum wages per depositor, about 228.3 million guaraníes or $36,800 at 6,200 to the dollar, the rate Última Hora used on 7 November, enough to protect about 97% of depositors in full, the BCP says.

Payouts for balances of up to 10 million guaraníes began on 5 November. By 7 November, 1,196,000 depositors had received 994.6 billion guaraníes, about $160m at that rate. By Le Détroit's calculation, that is about 830,000 guaraníes per saver, roughly $134: the first wave was one of very small balances.

The politics moved faster than the money. All 44 senators present voted on 6 November to remove President Santiago Peña; lawmakers accuse him of letting the state pension fund place $355m at the bank beyond legal limits. On 7 November judge Humberto Otazú ordered his pretrial detention for breach of trust and administration for personal benefit, Última Hora reported. Peña denies wrongdoing. His successor, Pedro Alliana, is also under investigation; neither has been convicted.

3. One centre, one provider, one guarantor

Shared plumbing is the second lesson. The Japanese outage hit 128 banks at once because they share a network run by the Shinkin Kyodo Center; Kyodo reported that they had updated their systems there in mid-October, though no link to the fault has been shown.

Arkéa's attackers "went through the platform of one of our providers", the bank said, then used its own account to wire money to other banks, from which it was converted into crypto-assets. Part is blocked. By Le Détroit's calculation, €100m equals about 43% of Arkéa's net profit of €230m in the first half of 2026.

SMBC Consumer Finance's leak fits the pattern. The breached system runs its guarantee business for card loans sold by regional, shinkin and internet banks, so one intrusion, detected on 2 November, exposed the borrowers of many lenders: Docomo SMTB Net Bank alone counts up to 122,635 of the 320,118. Names, incomes and driver's licence numbers leaked, but no ID images.

4. The insurer breached, and a dashboard taken for a siege

The week's most telling breach hit a safety net. Brazil's Fundo Garantidor de Créditos (FGC), which repays savers when a bank fails, said on 5 November that intruders had reached the systems behind its guarantee payments and accessed names, CPF tax numbers, emails and dates of birth. It first suspected the intrusion on 26 October. It reports no misuse or loss, has told the data regulator and has not said how many people are affected. As the FGC itself warns, the data could make scam calls more convincing.

Indonesia's alarming number is a screenshot. Local media reported about 350,600 "attack activities" on FortiGuard Labs' live threat map on 7 November, about 214,000 of them in banking, finance and insurance: 61% by our calculation, with about four detections a second overall. These are detections, not breaches; neither Fortinet nor BSSN, the national cyber agency, had confirmed them, and later readings gave different totals.

Malaysia shows the gap between noise and harm. The communications minister, Fahmi Fadzil, said the Bank Rakyat incident on 6 November was "limited to web defacement" of a site run by a third party, and that online transactions were safe. There is history: Bank Negara Malaysia fined it RM1m in January after an external intruder reached its IT systems.

5. Le Détroit's reading

The real story sits beneath the banks. Two incidents struck the institutions meant to catch customers when something fails: Paraguay's guarantee fund, paying out amid a presidential crisis, and Brazil's FGC, whose payout systems were breached. Paraguay's fund is paying, and the FGC reports no loss so far. But a deposit insurer's files are a list of people expecting money, and the FGC took ten days to say so publicly.

The other thread is concentration. One shared centre took 128 banks offline; one provider's platform opened Arkéa's own account; one guarantor's system exposed many lenders' borrowers; a third-party host carried Bank Rakyat's defacement. A bank can be sound on its own and still fail its customers through what it shares. The viral tally flattened all this, and its most alarming number, Indonesia's 350,600, tells customers least.