French Bank Crédit Mutuel Arkéa Faces EUR 118 Million Hack, With Funds Possibly Moved Into Crypto

The French banking group Crédit Mutuel Arkéa has confirmed on November 4 that its account was used by the hackers to carry out fraudulent transfers worth EUR 118 million (roughly Rs. 1,251.9 crore), and some of the money might have been converted into cryptocurrency. According to the lender, the perpetrators accessed the bank through the service provider's portal before they gained entry to the bank. They transferred the funds to other banks, where the funds might have been converted to cryptocurrency.

Crédit Mutuel Arkéa Rules Out Fortuneo as Entry Point for the Cyberattack

At the same time, the bank noted that the reported loss fell into the right bracket, but declined to specify the exact sum. Funds were frozen, while the process of recovering the rest of the money continues. The unauthorised transactions were made from an account of Crédit Mutuel Arkéa, and not of its customers.

The company denied allegations that the attackers gained access to the system through Fortuneo, which is an online banking unit of the company. In fact, the hackers attacked a certain unnamed service provider's platform and, through it, gained access to the banking company.

While the bank was able to determine where the attack had come from, the bank did not reveal the identity of the source, nor did it elaborate on what security flaws had led to the intrusion. The bank rejected all the assumptions made that it was due to an error committed by one of the bank employees, insisting that it was a “sophisticated attack from the outside.” After detecting any irregularities, the staff took emergency action to stop any more unauthorised transfers. Some banking processes were held up as the group analysed its systems and reinforced the security measures.

In its initial statement, the bank stated that the bank's operations were resuming on November 4th. Further to this statement, the bank stated that all services had resumed on the morning of that day following more checks. Transfers by customers faced some delay, although the bank maintained that their funds remained safe.

In response to the request for confirmation, the group said that “We do not confirm this information and can only validate the order of magnitude.” This does not give any final amount of losses since the authorities are still investigating the amount of money that has been stolen and the possibility of recovery. Based on the lender's statement, some of the lost amount has been blocked, but the details of the banks involved and the amount blocked are unknown.