In the wake of the announcement of a cyberattack, Crédit Mutuel Arkéa provides several clarifications about how the attack unfolded, its consequences for customers, and the amount at stake.
According to the banking group, the attackers used Arkéa’s own account to carry out transactions to other banking institutions. These operations could have “potentially” allowed them to convert the funds into cryptocurrency via specialized platforms.
The bank emphasizes one point: the hackers did not access customers’ accounts of its federations or subsidiaries. As soon as the attack was identified, it asserts, its teams activated the necessary security measures to contain the incident and prevent any new fraudulent movement.
Fortuneo Not Involved, a Provider at Issue
Several news articles had mentioned an intrusion via Fortuneo, the group’s online bank. Arkéa denies it: no “entry” was made through this subsidiary.
The attackers, according to the group, exploited the platform of one of its providers, which allowed them to reach Crédit Mutuel Arkéa directly. The provider’s identity is not disclosed.
Customers of the network as well as those of Fortuneo did not experience any impact on their assets, according to the bank. The only observed effect is a delayed execution of certain transfer operations, the result of a temporary suspension of some transactions decided as a precaution.
The incident is described as “under control.” The vast majority of operations resumed in the morning, after verifications were completed and enhanced security measures were put in place by the group and its subsidiaries.
Asked about a possible human error, the bank rules it out: it is a sophisticated external attack, now contained. It notes that its systems allowed rapid detection of suspicious activity.
The group also informed the competent authorities and supervisory bodies, in line with the usual procedures. Its teams are working with judicial and police authorities to determine the precise origin of the attack and how it operated, which remain to be determined.
€118 million: Not Confirmed, Not Denied
Regarding the amount of the damage, the wording is cautious. In the face of reports mentioning €118 million (about $133 million) stolen, Arkéa says it cannot confirm them and can only “validate the order of magnitude.”
The bank specifies that a portion of the funds involved could be blocked and that other measures are underway to recover them. Therefore, it is too early, in its view, to communicate a final figure. It does, however, affirm that the sums at stake are “in no way” sufficient to threaten its financial health and solidity.
