Overview
French banking group Crédit Mutuel Arkéa has confirmed a cyberattack in which hackers moved money out of the bank's own account after compromising an unnamed supplier. Blockchain investigator ZachXBT estimated the theft at more than $133 million, based on crypto exchange withdrawals and laundering transactions.
The bank has not confirmed the figure but said it could "validate the order of magnitude," and that the final loss has not been established.
What We Know
- Entry point: The bank says attackers compromised a service provider and used that route to reach the group's systems directly. It called the attack "sophisticated" and said it was not caused by human error.
- Method: The attackers made transfers from the bank's own account to other financial institutions, which allegedly helped convert the funds into cryptocurrency.
- Duration: The attack reportedly ran over several days.
- Subsidiary: The bank disputed reports that the breach began at Fortuneo, its online banking subsidiary.
- Customers: The bank states customer accounts were not accessed and customer assets are not affected.
Response
Arkéa activated its crisis procedures once the attack was detected and says the incident is "under control." Some of the converted assets have been frozen and the bank is working to recover the rest. It says the loss does not threaten its solvency. It is working with judicial and police authorities to determine the origin and method of the attack.
Takeaways for Defenders
- Vendor access is payment-path access. Review which suppliers can reach payment initiation or treasury systems.
- Add out-of-band controls on high-value transfers, such as dual approval and velocity limits that do not depend on a single supplier's integrity.
- Monitor outbound transfers for unusual destinations and rapid conversion to crypto exchanges.
- Have a freeze playbook with partner institutions so stolen funds can be frozen quickly.
Sources
- The Record: French bank confirms cyber heist