Crédit Mutuel Arkéa Suffers $133 Million Cyber Heist Linked to Service Provider

French cooperative bank Crédit Mutuel Arkéa experienced a cyberattack that facilitated fraudulent transactions amounting to $133 million, leading the bank to suspend certain systems.

The bank reported that the attacker exploited its own account to initiate transactions with other banking organizations, but confirmed that customer assets were not affected.

Crédit Mutuel Arkéa is a significant player in the French banking sector, serving over 5.8 million members and managing assets worth 211.5 billion euros.

Details of the incident surfaced on November 2, following alerts from blockchain fraud investigator ZachXBT, who noted a large-scale unauthorized withdrawal from multiple centralized exchange accounts the previous day.

ZachXBT estimated that the attacker may have stolen up to 118 million euros ($133 million), withdrawing the funds in USDC and USDT stablecoins.

At that time, the investigator did not disclose the bank’s identity, but indicated that the lack of public awareness enabled the attacker to launder $30 million by November 3, which would have been frozen by EU law enforcement.

Crédit Mutuel Arkéa publicly acknowledged the incident on November 4, assuring customers that the situation is now under control and operations are gradually returning to normal.

The bank stated, “Crédit Mutuel Arkéa wishes to reassure all its clients – across its federations and subsidiaries – that this incident has no impact on their assets; it has merely resulted in a delay in the execution of certain transfer transactions.”

Despite this assurance, the bank cautioned customers about an increased risk of phishing attacks, advising them to remain vigilant against unsolicited communications and to avoid sharing sensitive information via phone or email.

All suspicious messages should be verified by contacting the bank directly.

In a separate FAQ, the bank explained that the attacker accessed its network through a service provider’s platform but ruled out any involvement from Fortuneo.

The attacker used Arkéa’s own account for transactions with other banking institutions and to convert funds into cryptocurrency.

While the bank did not confirm ZachXBT’s estimate of the stolen amount, it acknowledged that the sum was significant and that some funds had been blocked.

When asked to confirm the figure of 118 million euros ($133 million) stolen, the bank stated, “We do not confirm this information and can only validate the order of magnitude.”

Crédit Mutuel Arkéa characterized the incident as a “sophisticated attack” and is collaborating with judicial authorities and law enforcement to determine the attack’s origin and methodology.

BleepingComputer has reached out to Crédit Mutuel Arkéa for further details regarding the attack and the ongoing investigations but has yet to receive a response.

Source: BleepingComputer