French Bank Crédit Mutuel Arkéa Reports €100 Million Loss in Cyberattack

French banking group Crédit Mutuel Arkéa has been hit by a sophisticated cyberattack that enabled hackers to make fraudulent transfers worth nearly €100 million, raising fresh concerns over the security of financial institutions.

The attackers gained access to an account belonging to Arkéa through the platform of one of its service providers. They then transferred funds to other banking institutions before converting the money into cryptocurrency through specialised platforms.

The bank said its customers' accounts were not affected and ruled out human error, describing the incident as an external attack. Some of the stolen funds have been blocked, while further recovery efforts are underway.

Contents

01

Paris Prosecutors Open Cybercrime Investigation

02

Banking Operations Resume as Customers Face Phishing Risks

03

Bank Says Attack Will Not Threaten Financial Stability

Paris Prosecutors Open Cybercrime Investigation

The Paris public prosecutor's cybercrime unit received a complaint from Crédit Mutuel Arkéa on Wednesday morning and immediately opened an investigation.

The case concerns an attack on an automated data processing system by an organised group. Investigators from France's Office for the Fight Against Cybercrime (OFAC) have been assigned to the case.

The stolen funds were transferred from Arkéa's own accounts to other banking institutions before being converted into cryptocurrency through specialised platforms.

Blockchain investigator ZachXBT had previously drawn attention to the incident, reporting that the stolen funds were routed through multiple accounts opened on cryptocurrency exchanges.

Neither the bank nor French authorities have identified those responsible. The attack has also not been publicly claimed by any individual or group, leaving investigators unable to establish whether it was a straightforward theft or an attack carried out by activists.

Arkéa declined to confirm the €118 million loss figure reported by French newspaper Le Télégramme, although it acknowledged that the amount was close to €100 million.

Banking Operations Resume as Customers Face Phishing Risks

Following the discovery of the attack, Arkéa temporarily suspended certain transactions as a precaution to secure its operations and prevent further fraudulent transfers.

The group and its subsidiaries subsequently carried out checks and introduced additional security measures. Almost all banking operations had resumed by the following morning, although some transfers were delayed.

The bank stressed that the incident had no impact on customer assets and that clients' accounts had not been compromised.

However, Arkéa warned customers to remain alert to possible phishing attempts following the cyberattack. While no customer data theft has been reported, the incident could create opportunities for unrelated cybercriminals to exploit public concern by sending fraudulent messages or impersonating the bank.

The group also notified the relevant authorities and supervisory bodies in line with its usual procedures.

Bank Says Attack Will Not Threaten Financial Stability

Crédit Mutuel Arkéa, headquartered near Brest in western France, said the financial impact of the incident would not undermine the group's overall financial position.

The bank reported a net profit of €230 million in the first half of the year and said the amount affected by the attack, which is still being assessed, was not large enough to threaten its financial health.

The incident comes less than a week after cryptocurrency exchange Binance disclosed a major security breach involving assets valued at $6.3 billion, adding to concerns over cybersecurity across the financial and digital asset industries.