Credit Mutuel Arkea launches recovery effort after €100m cyber theft

Hackers exploited third-party access in unprecedented attack

French banking group Credit Mutuel Arkea says hackers have stolen more than €100 million in a cyberattack, in an unusually major breach involving the theft of funds directly from a mainstream financial institution.

The bank said it was working to recover the money after attackers exploited an account belonging to the lender to carry out fraudulent transactions.

The incident, which became public on Wednesday, is being investigated by French prosecutors.

Credit Mutuel Arkea said the stolen funds were not cryptocurrency, although they may have been converted into digital assets after the theft.

The bank temporarily halted some transactions as a precautionary measure, causing delays to certain transfers. However, it stressed that customer accounts had not been affected.

Credit Mutuel Arkea, headquartered in Brittany, is a French co-operative banking group serving more than 5.8 million customers.

It has €211.5 billion in assets and belongs to the wider Credit Mutuel banking network.

Hackers allegedly exploited third-party access

According to French newspaper Le Monde, the attackers compromised the computer systems of a third-party service provider authorised to carry out transactions on behalf of the bank.

This reportedly gave the hackers extensive access to the bank's systems, allowing them to reach its equity capital and siphon off more than €100 million.

The stolen funds were subsequently converted into digital currencies and spread across multiple cryptocurrency exchanges.

Among the platforms involved was US-based exchange Kraken, which reportedly flagged the activity on Monday after detecting unusually large incoming transfers originating from a European bank. The exchange blocked transactions that were still in progress.

Credit Mutuel Arkea has declined to name the third-party provider whose systems were compromised.

A spokesperson also rejected media reports suggesting that Fortuneo, the group's online banking subsidiary, was the entry point for the attack. Fortuneo and its customers' accounts were not affected by the incident, the spokesperson said.

The bank confirmed that it had notified the European Central Bank, French banking regulator and prosecutors.

Concerns over financial sector cyberattacks

Cybersecurity experts said successful attacks resulting in the direct theft of money from major financial institutions remained relatively uncommon.

Rafay Baloch, chief executive of cybersecurity firm RedSecLabs, described the incident as unprecedented in Europe.

"We're seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions," he told Reuters.

Puneet Kakkar, managing director at investigations firm Nardello & Co in Paris, said any successful attack on the financial system was a significant concern.

French banks generally maintain strong cybersecurity defences because of strict regulatory requirements, but criminals were becoming increasingly opportunistic and creative, he said.

Gabriel de Brosses, founder of consulting firm Tevarua Conseil and a former head of cybersecurity at Groupe La Poste, said the incident would have consequences across the banking industry.

"This episode will send a wave of anxiety through every institution in the sector and will leave a mark," he said.

"Bankers, more than any other industry leaders, hate risk."

He described the incident as an attack of unprecedented scale and damage.

The attack follows a separate major cryptocurrency theft involving Binance, which disclosed earlier this week that hackers had stolen a record $6.3bn from the cryptocurrency exchange.

Binance said the attackers had used fake job interviews and a compromised internal artificial intelligence tool to gain access to its systems.