Hackers drained about €100 million from French bank Crédit Mutuel Arkéa (and never touched a customer account)
The bank says the attackers came in through a supplier's platform and used the group's own account to wire money to other banks, where it was likely converted into crypto. Part of it has been frozen, and Paris prosecutors have opened an investigation.
Crédit Mutuel Arkéa, the banking group behind Crédit Mutuel’s Brittany and South-West federations, has been hit by a cyberattack that siphoned off close to €100 million. The money did not come out of customers’ accounts. It came out of the bank’s own.
The group disclosed the attack on Wednesday and a few hours later put out a second statement answering the obvious questions. It will not confirm the €118 million reported by the regional press, but it accepts the “order of magnitude”. The provisional estimate doing the rounds is about €100 million.
How it happened
According to the bank, the attackers got in through an outside supplier’s platform and reached the group’s systems directly. From there they used Arkéa’s own account to send transfers to other banks, and the money was then probably turned into cryptocurrency on specialist exchanges.
Arkéa rules out human error on its side and calls it a “sophisticated” outside attack. It also denies reports that the way in was Fortuneo, its online bank.
Some of the money has already been frozen, and the bank is working to claw back the rest. For scale: the group made €230 million of net profit in the first half of the year, so the hit is somewhere between 43% and 51% of that, depending on which estimate you take.
What about customers?
Their money is untouched, the bank says, though not without some hassle. A number of transactions were paused as a precaution and some transfers went through late, until operations restarted on Wednesday morning.
The more useful warning is a different one. Arkéa expects a wave of phishing riding on the news and is telling customers never to hand over codes, passwords or card numbers in reply to a message.
The cybercrime section of the Paris prosecutor’s office has opened an investigation into organised hacking. Nobody has claimed the attack.
Coming in through a supplier is becoming a familiar pattern. It was also an outside contractor that opened the door in the attack that warmed up supermarket fridges across Europe, seven Intermarché stores in Portugal among them, and this one lands a week after Binance lost $6.3 billion in a single hack.
By Oliver Grant
Image: Kergourlay / Wikimedia Commons (CC BY-SA 4.0)
