The French banking group Crédit Mutuel Arkéa fell victim to a large-scale cyberattack, as a result of which the attackers siphoned off around €100 million. Having gained access to banking operations via a third-party service provider, the hackers carried out a series of fraudulent transfers, after which some of the funds may have been converted into cryptocurrency. The financial institution has temporarily suspended certain transactions, and the Paris public prosecutor’s office has launched a criminal investigation. The bank insists that customers’ funds have not been affected.
- Hackers have stolen approximately €100 million from the French bank Crédit Mutuel Arkéa.
- The cybercriminals gained access to the banking system via a third-party service provider’s platform.
- The stolen money may have been transferred to a cryptocurrency exchange and converted into digital assets.
- The bank has temporarily suspended certain transfers, but customers’ funds have not been affected.
- The Paris Public Prosecutor’s Office has launched an investigation, and some of the stolen funds have been frozen.
Hackers gained access via a third-party service and siphoned off the bank’s funds
The attackers gained access to one of the service providers’ platforms, through which they were able to carry out transactions on behalf of Crédit Mutuel Arkéa.
According to the bank, they used the financial institution’s own account to transfer funds to other banks. Subsequently, some of the money may have been transferred to cryptocurrency platforms to make it more difficult to trace and recover the assets.
The attack was not directed specifically at depositors’ accounts. Crédit Mutuel Arkéa emphasised that the attackers did not use customer accounts to steal funds.
After detecting suspicious transactions, the bank’s security department activated its internal response procedures. Some of the transfers were successfully blocked, and the subsequent movement of funds was restricted.
According to management, this appears to be a sophisticated external attack rather than an error on the part of staff. The exact method by which the platform was compromised and the identities of the attackers remain unknown.
The bank has confirmed a loss of around €100 million
On 5 November, Crédit Mutuel Arkéa announced that following cyberattacks There is a shortfall of approximately €100 million. This is one of the most extraordinary successful attacks, in terms of scale, on a traditional European financial institution.
Earlier, the French media had reported on the possible theft of €118 million, or approximately $133 million. However, the bank has not confirmed this figure.
Representatives of the organisation explained that the final losses are still being calculated. Part of the money has been frozen, whilst efforts to recover the remainder are ongoing.
The management emphasised that even significant financial losses do not threaten the stability of the banking group.
Crédit Mutuel Arkéa serves over 5.8 million customers, and its total assets amount to approximately €211.5 billion.
The stolen funds may have been converted into cryptocurrency
The investigators’ attention was particularly drawn to the route taken by the money.
Initially, the criminals carried out standard bank transfers. The funds would then be transferred to cryptocurrency platforms, where they were converted into digital assets.
This is an important distinction: no cryptocurrency was stolen from the bank. The attack targeted traditional funds, which could subsequently have been used to purchase crypto-assets.
Independent blockchain researcher ZachXBT had previously reported on the suspicious transactions. He had been tracking the movement of large sums via cryptocurrency platforms even before the cyberattack was officially confirmed.
Some of the withdrawn funds passed through cryptocurrency exchanges and wallets, before being converted into Ethereum and the DAI stablecoin.
Operators of certain platforms have frozen the suspicious assets. However, some of the money has already been transferred elsewhere, making it difficult to recover it.
Crédit Mutuel Arkéa has suspended some of its operations: what has happened to customers’ money?
Immediately after the attack was detected, the bank temporarily suspended some of its financial transactions to prevent further fraudulent transfers.
As a result, some customers experienced delays in their transfers. Following further checks and the tightening of security measures, most transactions were restored by the morning of 4 November.
The bank has separately denied reports that the attackers gained access to the system via its online division, Fortuneo. According to official information, they gained access via a third-party service provider’s platform. The accounts of Fortuneo customers and those of other divisions were not used to withdraw funds.
The bank states that customers’ assets remain unaffected and that the incident has not had any financial consequences for depositors.
The Paris Public Prosecutor’s Office is investigating a major bank robbery
After the cyberattack was detected, Crédit Mutuel Arkéa contacted the French law enforcement agencies and banking regulators.
The incident was reported to the European Central Bank and the French supervisory authorities.
The Paris Public Prosecutor’s Office has confirmed that its cybercrime unit received a report from the bank on 4 November and immediately launched an investigation.
The case is being treated as a possible organised attack on an automated data processing system. The French cyber police have been brought in to assist with the investigation. Law enforcement agencies are establishing how the third-party supplier’s system was breached, the route taken by the transfers, and the individuals involved in the crime.
Crédit Mutuel Arkéa has not yet disclosed the name of the compromised supplier.
Why did the attack cause concern amongst European banks?
European financial institutions devote significant resources to cybersecurity and operate under strict regulatory oversight. However, the incident involving Crédit Mutuel Arkéa has shown that risks can arise not only within banking systems, but also in third-party services integrated with them.
Experts have described the scale of the embezzlement as unusual for the traditional banking sector.
In particular, Rafai Baloch, head of RedSecLabs, highlighted the increasing sophistication of attacks targeting software interfaces and the mechanisms of interaction between financial institutions.
Similar problems have previously occurred outside Europe. In 2016, cybercriminals stole $81 million from the Bangladesh Central Bank’s account at the Federal Reserve Bank of New York.
In the case of Crédit Mutuel Arkéa, identifying the source of the breach and tracing the stolen funds – some of which may already have been converted into cryptocurrency assets – will be crucial to the ongoing investigation.
