Hackers steal from Credit Mutuel Arkea's own account in rare attack on a mainstream bank

A theft from the bank itself

Hackers carried out fraudulent transfers from the own account of Credit Mutuel Arkea, a French bank, in what is described as a rare instance of cybercriminals successfully stealing from a mainstream bank. ^[1][2] The bank says customer accounts and assets were not affected, which matters to account holders and to anyone whose transfers were delayed. ^[3][2]

The cyberattack was made public on Wednesday. ^[2] The bank said it was working to try to recover the stolen money. ^[2]

How the attackers got in

The bank said the attackers went through the platform of one of its service providers and reached the bank directly. ^[1] It declined to identify the third-party provider whose platform was used. ^[2]

The attackers used an account belonging to Credit Mutuel Arkea to carry out fraudulent transactions. ^[2] They sent transactions to other banks, which could have allowed them to convert the money into cryptocurrency. ^[1]

The funds were not in the form of cryptocurrency, the bank said, and could have been converted to crypto after being stolen. ^[2] The bank described the incident as a sophisticated attack from the outside, and said it was not the result of human error. ^[1]

A spokesperson rejected media reports that the bank's online banking subsidiary Fortuneo was the entry point for the attack. ^[2]

The response so far

Part of the funds involved has been frozen, and other steps are underway to recover the rest, the bank said. ^[1] As a precaution, it temporarily suspended some transactions, which delayed some transfers. ^[2]

The bank said it had informed the European Central Bank, French banking supervisors and prosecutors. ^[2] The Paris prosecutor's office said its cybercrime unit received a complaint from Credit Mutuel Arkea on Wednesday and immediately opened an investigation led by France's cybercrime police. ^[2]

The bank is working with judicial and police authorities to determine the origin of the attack and how it was carried out. ^[1]

What is known and what is not

Details of the attack first emerged on Monday in a report by ZachXBT, a pseudonymous blockchain investigator who later identified Arkéa as the alleged victim. ^[3] Arkéa confirmed the incident but declined to disclose the exact loss. ^[3]

The bank has not said when the attack began, who was behind it, or whether any data was taken. ^[1] ZachXBT said he was highly confident the incident was not the work of North Korea's Lazarus Group. ^[1]

Why analysts call it unusual

Cyber experts told Reuters that it was unusual for money to be stolen virtually from a bank. ^[2] Rafay Baloch, CEO of RedSecLabs, said the Credit Mutuel attack was unprecedented in Europe. ^[2]

Puneet Kakkar of Nardello & Co said any hit in the financial system is a big deal. ^[2] He also said French banks typically have strong cybersecurity due to regulatory requirements. ^[2]

Credit Mutuel Arkea is part of the wider Credit Mutuel banking network and is affiliated with its central body while retaining significant strategic autonomy. ^[2]

The wider pressure on Europe's banks

Financial regulators globally have stepped up warnings about the risk of cyberattacks, particularly with the growth of AI. ^[2] Earlier this week, the European Union said its agencies were holding urgent discussions with national authorities to coordinate a response to a growing wave of cyberattacks across Europe. ^[3]