The Biggest Cyberattack on a French Bank: How Can Banks Avoid a Breach Like the One at Crédit Mutuel Arkéa?

The cyberattack which hit the Crédit Mutuel Arkéa bank, causing damage which could exceed 100 million euros, raises many questions about how the hackers operated, and how to avoid new attacks. The bank denounced a “sophisticated attack coming from the outside”, and assured that there was no human error internally. The attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions with other banking players, which then potentially allowed them to convert this money into cryptocurrency via specialized platforms.

They therefore did not go through customer accounts of its federations or its subsidiaries", indicated the bank. "The operation is done in three stages", detailed to AFP Mathieu Françon, lawyer from the Bersay firm: "we divert traditional currency", "we transform it into crypto", then "we anonymize this crypto". Going from the second to the third stage is "very easy due to the gaps in the regulations, we do not regulate the tools which make it possible to anonymize the crypto today.”

Robbery 2. 0 Asked about the stolen sums (118 million euros according to certain media), Arkéa replied that it did not confirm this information but validated the "order of magnitude". After this "heist 2.

0", it's "a race against time that is underway" to find the stolen sums, says Antoine Hautin, secretary general of Almond, a cybersecurity consultancy. "Depending on the level of sophistication, maturity, of the attackers, it will be more complicated to trace the thread," he adds. We can try to "try to trace the financial flows", because digital "leaves traces", but "the advantage of cryptocurrencies is that it makes it more difficult to traceability of the sums that have been exfiltrated", underlines the expert.

As no one has claimed responsibility for the attack, it is not possible to know who is responsible for the theft. “The absence of a claim could tip the scales towards a purely villainous attack which serves to extort money,” according to Mr. Hautin.

Measures to be taken for the banking world "Concerning Crédit Mutuel Arkéa, we would be in an operation which would have taken place over several hours, even several days. The temporality of the attack raises questions", continues Mr. Hautin of the cybersecurity consultancy Almond.

For him, we must now "try to understand what happened, check if there is an issue surrounding the supplier in question: does it supply several banks?" Crédit Mutuel had in fact indicated on Wednesday that “the attackers went through the platform of one of our service providers”.

The question to ask is "a possible systemic risk" and therefore "identify whether the attack mechanism can be duplicated on other banks". Long-term consequences for the sector "We are facing the biggest IT attack on a banking player" in France, underlines Guillaume Seligmann, also a lawyer at the Bersay firm. “The effects induced on this entire industry due to the very strong between them are likely to have a truly disastrous impact,” he assures.

Machine-translated from French