More than 100 million euros stolen: an investigation opened after the cyberattack targeting Crédit Mutuel Arkéa

An investigation has been opened: Crédit Mutuel Arkéa declared that it had been the target of a “cyberattack” worth around 100 million euros, according to a provisional estimate, which the bank is trying to recover, it said this Wednesday evening in a press release. The cybercrime section of the Paris prosecutor's office was "recipient" on Wednesday morning of "a complaint" from the Crédit Mutuel Arkéa group and "immediately opened an investigation", said the public prosecutor on Wednesday evening, requested by AFP. The investigations relate to a “breach of an automated data processing system in an organized group” and were entrusted to the Anti-Cybercrime Office (OFAC), specifies the same source.

The hackers "used Crédit Mutuel Arkéa's own account to carry out transactions with other banking players" and then "converted this money into cryptocurrency via specialized platforms", according to the bank's press release. They "did not go through customer accounts of its federations or its subsidiaries", and contrary to what may have been written in the press, "no 'entry' was made through Fortuneo. The attackers went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly", insists the bank.

A human error at Arkéa is also ruled out by the bank, which explains that it “is a sophisticated attack coming from outside”. Arkéa did not confirm the amount of the embezzlement of 133 million dollars (118 million euros) cited by the newspaper Le Télégramme, but validated the order of magnitude. However, "part of the funds concerned may have been blocked, and other actions are underway to recover them", explains Crédit Mutuel Arkéa.

No claim In addition, "the amounts impacted by this attack, still being evaluated, were (...) not likely to call into question the solidity and financial health of the group". The banking group, whose headquarters is based near Brest, declares that the attack is “now contained”.

As soon as this cyberattack was detected, the teams mobilized and the decision was taken, "as a precautionary measure", to "temporarily suspend certain transactions in order to secure operations and prevent any new fraudulent movements", further details the group in a press release. Almost all operations were able to resume their course in the morning, after the group and its subsidiaries carried out checks and implemented reinforced security measures. Crédit Mutuel Arkéa wanted to “reassure all of its customers”: “this incident has no consequences for their assets and has only led to a deferred execution of certain transfer operations”.

As the attack has not yet been claimed, we cannot say whether it was a simple theft or a cyberattack carried out by activists. Phishing attempts The group however called on its customers to be extremely vigilant, because following this cyberattack, “phishing attempts are possible”. The banking group has not reported the theft of customer data, but this type of event could give rise to a second wave of scams carried out by opportunistic cybercriminals riding on customer concerns, which do not necessarily have a link with the first cyberattack.

Machine-translated from French