Hackers stole around €100 million from Crédit Mutuel Arkéa through a supplier platform. Customer funds were unaffected, and recovery efforts continue.
French banking group Crédit Mutuel Arkéa is working to recover money stolen through fraudulent transfers from its own account after attackers gained access through a service provider’s platform. Reuters reported on November 5 that the bank estimated the theft at around €100 million, while the final financial impact remains under assessment.
The bank said customer funds were unaffected, although some transfers were delayed while it contained the incident. Some stolen funds had been blocked, and efforts to recover additional money were continuing.
A subsequent update came on November 6, when Daniel Baal, president of the Confédération nationale du Crédit Mutuel, told France 5 that part of the money had been recovered. He did not disclose how much.
Attackers Used the Bank’s Own Account
In its November 4 statement, Arkéa said attackers reached it through a platform operated by an unnamed service provider. They then used the bank’s own account to transfer funds to other financial institutions, which the bank said may have allowed them to convert the money into cryptocurrency.
Arkéa rejected reports that its online subsidiary Fortuneo was the entry point. It also said the attackers did not use customer accounts belonging to its banking networks or subsidiaries.
The distinction is important when describing the theft. Money was taken from an account belonging to the bank, not directly from customers’ balances. Cryptocurrency appears in reports about the subsequent movement of funds, but the bank has not published a complete transaction trail.
Blockchain investigator ZachXBT first flagged suspicious withdrawals on November 2 and later identified Arkéa as the suspected victim. His analysis and French media reports put the amount higher, at approximately €118 million, or $133 million.
Arkéa has not confirmed that precise figure. Addressing it in its statement, the bank said, translated from French, “We do not confirm this information and can only validate the order of magnitude.”
The approximately €100 million figure reported by Reuters should therefore be treated as provisional, not a final loss after blocked funds and recoveries.
Supplier Access Remains Unexplained
Although Arkéa has identified a third-party platform as the route into its operations, it has not named the provider or explained how the attackers obtained access. Its statement describes an external attack and rejects human error at the bank as the cause, without providing enough technical detail to establish which controls failed.
French prosecutors have opened an investigation into the theft. Arkéa said it was working with judicial and police authorities and had notified the European Central Bank and French banking supervisors.
During the response, the group temporarily suspended certain transactions to prevent further fraudulent transfers. Most operations resumed on November 4 after checks and additional security measures.
Arkéa said the financial impact would not threaten the group’s financial health. Reuters reports that the banking group holds €211.5 billion in assets.
Customers Warned About Phishing
Following its disclosure, the bank warned that scammers could use news of the attack to approach customers with phishing messages. It urged people not to disclose banking usernames, passwords, card details or SMS verification codes, and to contact their bank adviser directly when checking suspicious communications.
That warning was precautionary. Arkéa’s public statements describe fraudulent transfers and do not establish that customer information was stolen.
The incident follows other recent attacks affecting French organisations, including supermarket refrigeration systems and the national blood service. Those cases involved different systems, and no connection to the Arkéa theft has been established.
Experts Question What Supplier Access Can Authorise
With the access method still undisclosed, Darin Fredde, Senior Director and Offensive Security Evangelist at Ridge Security, cautioned against assuming how the attack succeeded.
“We need to be careful about drawing conclusions from headlines. We know what Crédit Mutuel Arkéa has disclosed, but we don’t know the complete attack sequence. Speculating about which controls failed or how the attackers operated might make for an interesting story, but it doesn’t necessarily make anyone more secure,” Fredde told Hackread.com.
Waseem Ahmed, Head of Engineering at Secure.com, said suppliers with access to financial operations need to be assessed as part of the payment process.
“Any supplier whose platform has a path into your systems is part of your payment chain, whether or not it was meant to be, and it needs the same controls as the rest of that chain,” Ahmed said.
He recommended testing whether supplier access could authorise payments to unfamiliar recipients, together with limits that account for outgoing transfers from multiple systems.
“Test one path first: can someone who comes in through a supplier’s access send a payment to a beneficiary you have never paid before? Then cap outflows from your own accounts, counted across every system that can send money and over several days. Once outflows pass that cap, new or unusual payments should wait for approval.”
