French Bank Crédit Mutuel Arkéa Says About €100 Million Missing After Cyberattack
The Brittany-based bank said hackers used one of its accounts to move about €100 million out through fraudulent transfers, possibly converting the money into cryptocurrency. Customer accounts were not touched.
French bank Crédit Mutuel Arkéa said on Thursday it was missing about €100 million ($112.61 million) after a cyberattack this week, and it could not yet say how much of the money it will be able to recover.
The attackers used an account belonging to the bank to carry out “fraudulent transactions” to other banks, according to Reuters, possibly allowing the funds to be converted into cryptocurrency through specialized platforms. Le Monde reported that the hackers compromised the computer of a third party authorized to carry out transactions, giving them deep access to the bank’s systems, and reached the bank’s equity capital.
Customers were not affected, the bank says
The hack did not involve customer accounts, a bank spokesperson said on Thursday. The bank temporarily suspended some transactions as a precaution, which delayed some transfers, but customer assets were not affected, the spokesperson said. The bank also rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying there had been no “entry” through Fortuneo.
The bank said it had informed the European Central Bank, French banking supervisors and prosecutors. The Paris prosecutor’s office said its cybercrime unit received a complaint from the bank on Wednesday and opened an investigation into an organized attack on an automated data processing system.
The money trail ran through crypto exchanges
Le Monde reported that the stolen funds were converted into cryptocurrencies and spread across several exchange platforms. The American platform Kraken sounded the alarm on Monday after receiving unusually large transfers for a European bank and blocked the transactions in progress. The independent crypto investigator known as ZachXBT first spotted the suspicious movements on Monday and said the operation did not originate from North Korea, according to Le Monde.
The attack follows the theft last week of $6.3 billion in cryptocurrency from the Binance exchange. The bank, which has more than 5.8 million customers and €211.5 billion in assets, posts €430 million in annual profit, Le Monde reported, so the theft equals about a quarter of a year’s profit. It is still too early to identify those behind the Arkéa attack, Le Monde reported.
Reporting based on coverage by Reuters and Le Monde.
