Crédit Mutuel Arkéa cyberattack, Digi Mart USA News (France): French banking and insurance group Crédit Mutuel Arkéa, based in Brittany and behind Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, disclosed on November 4 that attackers had transferred around €100 million (about $112 million) from its account via instant payments.
In an interview with AFP published on November 12, chairman Julien Carmona called the attack unprecedented “in terms of sophistication” and said the financial consequences amount to around €100 million, roughly 1% of the group’s equity or one quarter’s earnings. He said the bank’s solidity is “absolutely not affected.” According to Reuters, the attack targeted the bank’s own account rather than its customers’ accounts.
The breach began outside the bank. On October 27, the bank found signs that a service provider’s systems had been compromised, cut the connection between the two and notified the authorities.
Carmona said nothing at that point showed that information had been taken from the third party to enter the bank’s own system. The bank has not named the provider.
According to the bank, the attackers generated fake Fortuneo IBANs and used them to trigger payment orders from the group’s account to outside parties through instant payment systems, which Carmona said have fewer controls than classic transfers. The transfers began on Sunday, November 1. The money reached accounts at other European banks that the fraudsters had opened, and was then moved to crypto platforms.
The bank discovered the scale of the fraud on the morning of Tuesday, November 3. It cut all external access to its information system and its connection to the interbank payment system, removed the fake accounts and changed all authentication credentials before going public on November 4. Carmona told Les Echos that Fortuneo’s systems, and therefore its customers, were not affected.
Crypto-asset investigator ZachXBT flagged more than $106 million in suspicious withdrawals on November 2, later raising the estimate to more than $133 million and naming Crédit Mutuel Arkéa on November 4, according to CoinDesk. Blockchain analytics firm Bitquery traced $108.8 million in USDC withdrawn from accounts at several crypto platforms over 21 hours on November 1 and 2. Crypto.com said it had blocked funds linked to the incident, and OKX said it had frozen an institutional customer account.
The bank has not published a final loss figure because it hopes to recover some of the money. Carmona said part of the funds had been recovered and discussions over the rest were ongoing, and the bank is in talks with its insurer.
Reuters reported that the Paris prosecutor’s cybercrime unit opened an investigation after receiving the bank’s complaint on November 4.
Carmona described the attackers as a “very well organized, very well equipped, very well tooled criminal group” and said the attack was “very likely aided by advanced artificial intelligence.” No one has claimed responsibility, and he has not explained what the AI supposedly did. The techniques disclosed so far, including a compromised supplier, fraudulent payment orders, mule accounts and crypto laundering, are long established and do not by themselves require AI.
