Cyberattack on Crédit Mutuel Arkéa: a hacked service provider, millions laundered in crypto… everything we know about the current investigation

Crédit Mutuel Arkéa was the victim of a cyberattack. More than 100 million euros were stolen. The hackers went through a bank service provider, before making the money disappear through the twists and turns of the blockchain and cryptocurrencies. The Paris prosecutor's office has opened an investigation to try to trace the cybercriminals.

This Wednesday, November 4, Crédit Mutuel Arkéa admitted to having been the victim of a major cyberattack. The offensive ended with “the carrying out of fraudulent operations” which caused more than 100 million euros to disappear. The group, which has 5.6 million customers in France, assures that the incident is now “contained”.

According to information circulating, the hackers embezzled 133 million dollars, or approximately 118 million euros. Arkéa does not confirm this figure, but recognizes that it is indeed the right order of magnitude. The bank specifies that the attack “has no financial consequences” for its customers. On Wednesday, however, certain transactions were suspended, “to secure operations and prevent any additional fraudulent transfers”. The mobile application also remained inaccessible for a good part of the day.

A few hours after the hacking announcement, Arkéa communicated some details on the circumstances of the attack. Questioned by AFP, the Breton bank revealed that the attackers “went through the platform of one of our service providers”. The hackers preferred to attack the computer systems of a service provider, whose identity remained unknown, rather than directly targeting those of the bank. It can be assumed that a security flaw or weakness has been detected by the hackers.

They then “used Crédit Mutuel Arkéa’s own account” to issue transfers to other banks. As expected, it was not the customers' money that was targeted, but that of the bank itself. Arkéa assures that the hackers did not use any account of its federations or its subsidiaries. Contrary to what several sources claimed in the wake of the attack, “no entry was made through Fortuneo”, the group’s online bank, Arkèa specifies. The bank rules out the possibility of an internal human error, which would have opened the door to crooks. She points to “a sophisticated attack coming from the outside”.

Once out of the bank, the money was converted into cryptocurrencies. According to crypto journalist Grégory Raymond, who cites several sources, the transfers landed on accounts opened with false identities on crypto exchange platforms, such as Kraken, OKX or Crypto.com. Behind these fictitious accounts, we find “perfectly well-established structures”, according to one of its sources. Euros were quickly exchanged for stablecoins, cryptocurrencies whose value is backed by that of a fiat currency, generally the dollar.

Machine-translated from French