Hackers stole tens of millions of euros from Crédit Mutuel Arkéa through a service provider

The first public signal did not come from the bank. On Monday, November 2, ZachXBT, a US investigator who specializes in tracing cryptocurrency and publishes under a pseudonym, flagged suspicious fund movements on Telegram. He then named Crédit Mutuel Arkéa as the victim, according to The Record. On Wednesday, November 4, the Breton banking group confirmed in a statement that it had suffered a "sophisticated external attack."

What the bank has said since changes how the case reads. The hackers did not get in through customer accounts or through Fortuneo, its online bank, contrary to what was circulating on social media. They used the platform of one of its service providers, which it does not name, to reach the group directly. They then used Arkéa's own account to send transfers to other banks. The money was then converted into cryptocurrency and spread across many wallets, franceinfo reports.

How much was stolen?

The question remains open. Specialists cited by franceinfo put the figure at €118 million ($133 million). "We do not confirm this information," Arkéa replies, saying it can "simply validate the order of magnitude," which franceinfo describes as several tens of millions of euros. According to AFP, the bank itself gave a figure "on the order of €100 million" in a statement on the evening of November 4, as a provisional estimate. The final amount has not been established.

Part of the funds could be blocked and other recovery efforts are under way, according to the bank. Asked by the site Cointelegraph, the exchange Kraken said it had "restricted" suspicious accounts. Crypto.com says it took appropriate measures to prevent funds linked to the incident from passing through its platform.

Arkéa says the loss does not threaten its financial strength. The group posted €230 million in net profit in the first half, franceinfo notes.

An investigation into hacking by an "organized gang"

The cybercrime section of the Paris prosecutor's office received the group's complaint on the morning of November 4. It immediately opened an investigation for "attack on an automated data processing system by an organized gang," entrusted to the Office anticybercriminalité (Ofac, the French anti-cybercrime office). Not to be confused with the US sanctions agency that has the same acronym.

No group has claimed the attack. The bank rules out any "human error" but does not explain how the service provider was compromised. Gabriel de Brosses, head of the firm Tevarua Conseil, tells Le Monde that it is "an attack of unprecedented scale and damage." In his view, checks on financial movements should have spotted the operation, and the attackers knew banking procedures very well.

For customers, the danger now comes from fake messages

The group includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, for more than 5.5 million customers in total, according to TF1 Info. Arkéa says their assets are not affected and reports no data theft. The only announced consequence: some transfers were executed late. Almost all operations had resumed on the morning of November 4.

No data was stolen, then, but the news is something scammers can exploit: the bank warns of fraudulent messages impersonating it. Good habits to follow:

• do not click any link received by text message or email that mentions "the incident," a refund or an account check;
• hang up if a caller asks you to validate a transaction or give a code, even if the number displayed appears to be the bank's, then call your branch back yourself;
• check your accounts only from the official app or by typing the website address yourself.

Who is this service provider?

For businesses, the lesson goes beyond the Breton bank: a provider's platform can open the door all the way to its client's funds. On the identity of this provider and how it was compromised, discretion remains total. The Ofac investigation will have to say whether it worked for other institutions, and whether they have reason to worry.