A French Bank Says Attackers Moved Its Own Money After Coming In Through a Vendor. It Puts the Loss in the $133 Million Range

When a bank is hit, the first question is usually whether customer deposits moved. Crédit Mutuel Arkéa’s answer this week was no: the money that left belonged to the institution itself, and the path in was a service provider, not a customer login.

The Record reported the group’s Wednesday statement, which matches the additional information Arkéa published from Brest on November 4.

What the bank says happened

• Attackers used Crédit Mutuel Arkéa’s own account to send transactions to other banks. Those transfers, the group said, may then have allowed the money to be converted into cryptocurrency on specialized platforms.
• Customer accounts at its federations and subsidiaries were not used, and the group said the incident has no financial consequences for customers’ assets. The visible customer effect was a delay in some transfers.
• The attackers did not get in through Fortuneo, its online-banking subsidiary, contrary to some earlier press reports. They went through the platform of one of the group’s service providers and reached Crédit Mutuel Arkéa directly. The provider was not named.
• The group called the incident a sophisticated attack from outside, not the result of human error at Arkéa, and said its security systems spotted the suspicious activity quickly.

The dollar figure, carefully stated

Blockchain investigator ZachXBT had estimated the theft at more than $133 million, The Record reported, based on withdrawals from cryptocurrency-exchange accounts and transactions intended to launder the assets. Asked whether it could confirm that 118 million euros ($133 million) were stolen, Arkéa said it does not confirm that information and can only validate the order of magnitude. It added that some of the funds have been blocked, that other recovery work is underway, and that it is too early to publish a final amount. The sums involved, it said, are not of a nature to undermine the group’s financial strength. In the same notice the group listed total assets of €211.5 billion, with more than 5.8 million members and customers and 12,073 employees.

Containment and what comes next

Once the attack was detected, Arkéa said it activated existing crisis procedures, told the relevant authorities and supervisors, and temporarily suspended some transactions to stop further fraudulent movements. By the morning after the detailed notice, it said almost all operations had resumed following extra checks and enhanced security measures. The group said it is working with judicial and law-enforcement authorities to pin down the origin and method of the attack. It also warned customers, as a precaution, to watch for phishing that often follows news of an incident like this—not because it reported that customer data had been stolen, but because copycat messages are common.

What this means for your company

You do not have to be a bank for this pattern to apply. A vendor that can initiate payments, reset access or reach your finance systems is part of your security perimeter, even if that vendor never appears on your network diagram. Ask which third parties can move money or approve transfers in your name, what approvals sit on those actions, how quickly you would notice an unusual payment, and whether you can cut that access without shutting the business down. The Arkéa episode is also a reminder to say clearly, as soon as you can, whose money moved and whose did not—customers will hear a number on social media long before your final loss figure is ready.

Want a practical review of which vendors can move money or reset access in your name? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.

About The Author

L7 News

See author's posts