Crédit Mutuel Arkéa cyberattack, Digi Mart USA News: French banking group Crédit Mutuel Arkéa lost around €100 million (about $112 million) after attackers used a compromised service provider to gain access to its systems and transfer the funds via instant payments, according to the bank’s chairman, Julien Carmona, speaking to AFP.
The bank, based in Brittany and behind Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and the online bank Fortuneo, disclosed the attack on November 4. Carmona described it to AFP, published November 12, as unprecedented “in terms of sophistication” and said the loss is roughly 1% of the group’s equity, so the bank’s solidity is “absolutely not affected.” Reuters reported that the attack targeted the bank’s own account rather than its customers’ accounts.
According to Carmona, the breach began outside the bank. On October 27, the bank found signs that a service provider’s systems had been compromised, cut the connection and notified the authorities.
Carmona said nothing at that point showed that information had been taken from that third party and used to enter the bank’s own system. The bank has not named the provider.
Carmona said the attackers created fake Fortuneo IBANs and used them to trigger payment orders from the bank’s account through instant payment systems, which he said have fewer controls than classic transfers. The transfers began on Sunday, November 1. The money went to accounts at other European banks that the fraudsters had opened, and then moved to crypto platforms.
Carmona said the bank discovered the scale of the fraud on the morning of Tuesday, November 3, cut external access, removed the fake accounts and changed authentication credentials before going public the next day. He told Les Echos that Fortuneo’s systems, and therefore its customers, were not affected.
Blockchain sleuth ZachXBT and analytics firm Bitquery reported suspicious crypto withdrawals earlier, with ZachXBT naming the bank on November 4, according to CoinDesk. Crypto.com said it had blocked linked funds and OKX said it had frozen an institutional customer account.
ZachXBT said he had a “high degree of confidence” that North Korea’s Lazarus Group was not behind the attack.
The bank has not published a final loss figure because it hopes to recover some of the money. Carmona said part of the funds had been recovered and talks over the rest are ongoing, with discussions also underway with its insurer.
Reuters reported that the Paris prosecutor’s cybercrime unit opened an investigation after receiving the bank’s complaint on November 4.
Carmona called the attackers a well-organised criminal group “very likely aided by advanced artificial intelligence,” but no one has claimed responsibility and he has not explained what role AI played. The techniques described so far, including a compromised supplier, stolen access, fraudulent payment orders and crypto laundering, are long established and do not by themselves require AI.
