French Bank Reports Service-Provider Attack; $133M Loss Estimate Unconfirmed

Summary

Crédit Mutuel Arkéa says an attacker reached its network through a service provider’s platform and used the bank’s account for fraudulent transfers. ZachXBT estimated losses at $133 million, but the bank did not confirm that figure.

Key points

• Crédit Mutuel Arkéa said the attacker reached its network through a service provider’s platform; it ruled out Fortuneo.
• The attacker used the bank’s own account—not customer accounts—to make transactions with other banking organizations and convert funds to cryptocurrency.
• Investigator ZachXBT estimated that up to €118 million ($133 million) was stolen; the bank did not confirm the amount, saying only that it was significant.
• The bank said some funds were blocked and that customer assets were unaffected.
• The bank described the incident as under control, with operations gradually returning to normal, and is working with judicial authorities and police to establish how it happened.
• The bank warned customers about increased phishing risk and advised verifying suspicious messages directly with a bank adviser.

People

Industries