Cyber Attack on France's Crédit Mutuel Arkéa Bank, Suspected Theft of Millions

A cyber attack on Crédit Mutuel Arkéa, one of France's largest cooperative banking groups, has once again highlighted the risks posed by third-party service providers in the financial sector. Following the incident, disclosed on November 4, financial regulators and law enforcement officials have launched an investigation. Cyber security experts believe this incident could become one of Europe's largest banking cyber events of the year.

According to official statements released by Crédit Mutuel Arkéa, cybercriminals gained entry into the bank's environment through a third-party service provider's platform. The bank clarified that, contrary to some reports circulating on social media and industry forums, the attack did not occur through its online banking subsidiary, Fortuneo.

Investigations have revealed that after gaining access to the bank's system, the attackers used the bank's own accounts to make unauthorised transfers to other financial institutions. Investigators are now assessing how the attackers progressed through trusted systems and obtained the necessary access to initiate financial transactions.

The scale of the financial loss is still under investigation. According to a report by independent blockchain investigator ZachXBT, approximately €118 million (about $133 million) may have been stolen. It is believed that this amount was transferred through multiple accounts and possibly sent to cryptocurrency platforms to conceal its movement. However, the bank has not confirmed the exact amount and stated that recovery efforts are underway.

The bank has announced that this incident has had no impact on customers' accounts, savings, or assets. The fraudulent transfers were made using the bank's own accounts rather than those of retail or corporate customers, providing relief to millions of customers across France.

The bank confirmed that suspicious activity was detected by its security monitoring systems, leading to the activation of crisis management procedures and immediate containment measures. Some transactions were temporarily suspended during the investigation and to strengthen controls. Most operations resumed shortly thereafter, although some customers experienced delays in transfers.

Cyber security professionals consider this attack a prime example of a 'supply-chain compromise'. According to a Gulf News report, instead of attacking the financial institution directly, the attackers exploited vulnerabilities of a trusted third-party provider to reach the bank. Industry analysts note that this incident teaches banks important lessons, emphasizing the need for continuous assessment of supplier security, strict privileged-access management, and the use of behavioural analytics to monitor high-value transactions.