Credit Mutuel Arkea, a French cooperative banking group with more than 5.8 million members, says it was hit by a cyberattack that let an outside attacker make fraudulent transfers of up to roughly $133 million (118 million euros). The bank disclosed the incident on November 4 and says it is now “closed and under control.” Reports of the theft surfaced on November 2 from blockchain investigator ZachXBT, who said the money left the bank on November 1 and was withdrawn as USDC and USDT stablecoins, with about $30 million laundered by November 3. ZachXBT’s figures are his own estimates; BleepingComputer reports the bank did not confirm the amount.
According to the bank’s own FAQ, the attackers got in through the platform of one of its service providers and reached the bank directly. They then used Arkea’s own account (not customer accounts) to send money to other banks, which could potentially let them convert it to cryptocurrency through specialized platforms. The bank rules out an entry through its Fortuneo subsidiary, as some press reports had suggested, and rules out human error, calling it a “sophisticated attack” from outside. To contain it, the bank temporarily suspended certain transactions, which delayed some customer transfers; it says nearly all operations resumed on the morning of November 4. It says some of the funds were blocked and other recovery actions are under way, and that it is working with judicial authorities and police on the origin and method. Asked whether 118 million euros was stolen, the bank answered that it does not confirm the figure and “can only validate the order of magnitude.” The bank has not named the service provider.
For customers, the bank says the incident has no consequence for their assets. The bank notes that attacks of this kind are often followed by a rise in phishing, so it urges customers to be wary of unsolicited calls, emails or messages and to verify anything suspicious by calling their bank adviser directly. Its FAQ says this is a general precaution and does not by itself mean customer data was compromised.
Sources
- Credit Mutuel Arkea, additional information following the attack (FAQ, in French)
- Credit Mutuel Arkea press release of November 4 (PDF, in French; linked from BleepingComputer, not read directly)
- ZachXBT, Telegram post on the fund movements (linked from BleepingComputer; the post did not render for us, so figures are attributed to BleepingComputer)
- BleepingComputer: Hackers pull off $133 million French bank heist via service provider