Crédit Mutuel Arkéa cyberattack, Digi Mart USA News: The cyberattack that hit the French bank Crédit Mutuel Arkéa, with potential losses that could exceed 100 million euros, raises many questions about how the attackers operated and how similar incidents can be avoided. The bank described it as a “sophisticated attack from outside” and said there was no human error on its side.
According to the bank, the attackers used Crédit Mutuel Arkéa’s own account to carry out transactions toward other banking institutions, which could then have allowed them to convert the money into cryptocurrency through specialized platforms. The bank said they did not go through accounts of its customers in its federations or subsidiaries.
Mathieu Françon, a lawyer at the firm Bersay, told AFP that the operation takes place in three stages: diverting traditional currency, converting it into crypto, and then anonymizing that crypto. He said moving from the second to the third stage is “very easy due to gaps in regulation,” since the tools used to anonymize crypto are not currently regulated.
Asked about the amount stolen, which some media outlets have reported as 118 million euros, Arkéa said it did not confirm those figures but endorsed their order of magnitude. Antoine Hautin, secretary general of the cybersecurity consulting firm Almond, said the race to recover the stolen funds is now underway.
He noted that tracing the funds becomes harder depending on the attackers’ level of sophistication, and that cryptocurrencies make it more difficult to trace the stolen sums.
No group has claimed responsibility for the attack, so it is not possible to say who is behind the theft. Hautin said the lack of a claim could point toward a purely criminal attack aimed at extorting money.
Hautin added that the attack may have unfolded over several hours or even several days, which raises questions. He said it is necessary to understand what happened and determine whether the implicated service provider serves several banks.
The bank had earlier said on Wednesday that “the attackers went through the platform of one of our service providers.” The key question, he said, is whether there is a possible systemic risk and whether the attack mechanism could be replicated at other banks.
Guillaume Seligmann, also a lawyer at Bersay, said this is the largest cyberattack on a banking player in France. He warned that the effects on the entire industry, given the strong correlation between institutions, could be seriously damaging.
He recommended pooling resources and standards across all financial players to fight cyberattacks, and ending the working in “silos.”
Françon suggested that stronger controls be introduced at the point of conversion between traditional currency and crypto, such as a latency period to verify that certain transactions are not fraudulent.
