Crédit Mutuel Arkéa says attackers took about €100 million via supplier access
For the head of payments operations at a regional bank
French bank Crédit Mutuel Arkéa disclosed on Nov. 4 that attackers had reached it through a service provider's platform and used its own account to send money to other banks, and on Nov. 5 put the amount at about €100 million, according to Reuters as cited by The Asian Banker.2
Chair Julien Carmona told AFP, as relayed by PC Gamer from a Boursorama report, that the attackers created fake IBANs, including some from Fortuneo, to trigger payment orders from Arkéa's own account to outside parties over instant payment systems, which he said have fewer controls than classic transfers.1 Carmona told Les Echos the compromised provider's name is withheld by a collective decision of the banks, because naming it could harm banking security and expose similar providers; PC Gamer reported that the attackers used it to gain privileged access.1
PC Gamer reported that the hacking group apparently began on Sunday, Nov. 1, and that the activity was not spotted until Tuesday, Nov. 3, when access to the bank's information system was cut off.1
The funds went to legitimate European banks and were then spent on crypto platforms, PC Gamer reported; crypto specialists the bank brought in reportedly saw abnormal transactions on Sunday and Monday, but Carmona said no one to his knowledge linked them to Arkéa.1
Carmona told Les Echos that Fortuneo's system and customers were not affected, and The Asian Banker reported that Arkéa suspended selected transactions, blocked some of the funds and is pursuing recovery, leaving its final loss undetermined.12
Carmona said the group was "very likely aided by advanced artificial intelligence"; PC Gamer wrote that it is not yet clear what role AI played, and the sources give no further detail on it.1
The reported route was an inside payment order over instant rails, which a bank may treat as legitimate by default, so supplier access could matter more than customer-side fraud controls. Banks may want to review which vendors can reach payment-initiation functions and what limits or checks apply to the bank's own account.
The Paris prosecutor's cybercrime unit has opened an investigation and Arkéa is pursuing recovery of the blocked funds; the sources give no dates for either.2
Our take. Arkéa lost about €100m from its own account over instant rails, which carry fewer controls than classic transfers, and no one connected the dots until the third day. Most fraud controls watch customers, not the bank's own account.
Action. Payments operations: Set instant-payment outbound limits and anomaly alerts on the bank's own operating accounts, including orders initiated through third-party service providers.