The Essentials
The president of Crédit Mutuel Arkéa, Julien Carmona, lays out the mechanism of the cyberattack that led to the misappropriation of around €100 million. The attackers exploited a supplier’s compromise, then used fake IBANs and instant transfers to move the funds to bank accounts before converting them into cryptocurrencies.
- An initial intrusion at a provider: on October 27, Arkéa detects signs of a compromise in the information system of a supplier. The bank immediately cuts the connection between the two systems, without initially recognizing that this breach could be used to access its own information system.
- Fake Fortuneo IBANs: the attackers generate counterfeit IBANs in the name of Arkéa’s subsidiary to trigger payments from the bank’s own accounts outward. They favor instant transfers, which are subject to fewer controls than standard transfers.
- A prepared money-laundering circuit: the sums are moved to real accounts opened by the fraudsters in other European banks, then directed to cryptocurrency platforms to obscure the trail.
- A late detection of the scale: the fraudulent movements are identified on the morning of November 3. Arkéa then cuts external access and its connection to the payment system, before removing the fake accounts and renewing the authentication credentials.
- A damages still provisional: Carmona confirms an amount close to €100 million, or about 1% of the group’s equity. Some of the funds have been recovered or frozen, but discussions continue with several banks and platforms.
- An attribution still unknown: no claim has been received. The president mentions a highly organized criminal group and believes the attack was probably aided by advanced AI, without providing any element to confirm their precise role.
A week after the cyberattack that struck Crédit Mutuel Arkéa, its president, Julien Carmona, detailed the sequence of events in an interview with AFP.
The executive speaks of an attack unprecedented in its sophistication and technicality and confirms that the loss stands at about €100 million, roughly 1% of the group’s equity, and the equivalent of one quarter of its earnings.
According to him, Crédit Mutuel Arkéa is the first French bank, and probably European, to suffer such a fraudulent attack carried out to completion.
Everything begins on October 27. The bank detects signs of an intrusion into the information system of one of its service providers. It promptly severs the connection between the two systems and alerts authorities. At this stage, Carmona says, nothing suggested that the attackers could have used it to penetrate Arkéa’s network. He describes the attack as very likely aided by advanced artificial intelligences.
Fake Fortuneo IBANs and Instant Transfers
The attackers generated fake Fortuneo IBANs, the group’s subsidiary, to initiate payment orders from Arkéa’s own account to external recipients. They leveraged instant-payment systems, which inherently have fewer controls than traditional transfers. The operations began on Sunday, November 1. Everything was engineered to present these illegitimate transfers as normal transactions.
The funds first moved to real accounts opened in other European banks. These are genuine accounts created by the fraudsters, which, according to the president, points to long-planned preparation. The money was then steered toward cryptocurrency platforms to obscure the trail.
The scale of the fraudulent movements was discovered on the morning of Tuesday, November 3. Arkéa then cut all external access to its system and its connection to the market’s payment system, in order to limit losses and prevent the attack from spreading.
The bank then launched a cleanup operation: identifying and deleting the fake accounts, changing all authentication credentials. It publicly announced the measures on Wednesday, November 4.
Julien Carmona defends one point. If crypto-asset specialists observed anomalous transactions as early as Sunday and Monday, no one had yet linked them to Arkéa.
Funds Partially Recovered
The bank has not yet published a definitive balance sheet. It hopes to recover more funds, as banks and, at times, crypto platforms may have delayed operations and frozen part of the assets due to their vigilance obligations. Some amounts have already been recovered, others are the subject of ongoing discussions. Arkéa is also in talks with its insurer.
The president says he relies on the police and judicial investigation, whose international cooperation resources exceed those of the bank. He has received no claims and does not know who is behind the attack. Based on the information available, he speaks of a highly organized, well-equipped and well-supported criminal group.
