“The dubious honor of being the first French bank successfully attacked”: the boss of Crédit Mutuel Arkéa recounts the 100 million euro computer heist

The cyberattack which affected Crédit Mutuel Arkéa last week is "unprecedented in terms of sophistication" and "technicality", declared its president Julien Carmona in an interview with AFP, who details the unfolding of this "heist of a new kind". Stating that he had the "dubious honor of being the first French, and I believe European, bank to be the subject of a successful fraudulent attack (...)", the president of the bank based near Brest confirmed that the financial consequences were around "around a hundred million euros".

Either "1% of the company's equity", or "the equivalent of a quarter of results", "so the solidity of the establishment is absolutely not affected", he assures. The president of Arkéa indicates that he has no “information”, nor “claims” from the attackers. “We can speak, given the state of our information (...

) of a very well organized, very well equipped, very well equipped criminal group", which carried out a "heist or robbery of a new kind". On October 27 the bank detected "indications according to which the information system (of a) service provider had been compromised, and had been the subject of an intrusion", says the manager. "As soon as we notice this, we cut off access between our system and that of this service provider and we make declarations to the competent authorities", he explains.

“But at this time, nothing allows us to detect that elements were recovered from this third party in order to then be able to enter our own information system,” underlines the president of Arkéa who describes “an attack of particular subtlety”, “very probably aided by advanced artificial intelligence”. “Thwarting controls” “False Fortuneo IBANs”, a subsidiary of the group, “were generated and used to trigger payment orders from Crédit Mutuel Arkéa's own account to the outside world using instant payment systems”, which have “by definition, fewer controls than on traditional transfers”, according to Mr. Carmona.

“They started on Sunday, November 1, doing everything they could to thwart the controls, to pass off these illegitimate transfers as legitimate transfers,” he adds. The embezzled sums go to accounts in other “legitimate” European banks. “I think that this attack was planned for a long time,” said Mr.

Carmona, because “these are real bank accounts, but opened by fraudsters”. Then, “the money goes to crypto platforms, obviously in order to anonymize the use.” “We discovered the scale of the attack and the fact that it resulted in fraudulent movements on the morning of Tuesday” November 3.

“We reacted as necessary, in crisis management, by cutting off all external access to our information system, and by cutting off access to the on-site payment system to be able to avoid additional losses, but above all the spread of the attack.” The bank is launching a "cleaning operation", by "identifying all these false accounts, eliminating them", and changing "all authentications". It was at the end of this work that the bank communicated about the attack, on Wednesday 4.

Recovery of funds Since then "we have carried out many internal investigations and brought in external service providers, cyber specialists in particular, to fully understand what happened and then strengthen our defense systems for the future", explains the president of the bank. Cryptoasset specialists "say they have seen, from Sunday and Monday, abnormal transactions going to crypto platforms. But, at that time, they themselves, and no one to my knowledge, made the link with Crédit Mutuel Arkéa", he defends.

If Crédit Mutuel Arkéa does not provide a definitive report on this theft, it is because it hopes to recover part of the funds. The bank is also in discussions with its insurer. “In a certain number of cases, banks, or even crypto platforms, have been able to delay operations and freeze part of the funds.

To carry out their own obligations of vigilance". Some funds "were able to be recovered and for others, discussions are still ongoing", specifies the president of Arkéa who "is counting a lot on the police and judicial investigation, because they have means of international cooperation which we do not have".

Machine-translated from French