On November 5, French banking group Crédit Mutuel Arkéa reported a significant cyber theft estimated at around €100 million, which was executed through a supplier platform. The bank has assured that customer funds remained secure during this incident, although some transfers faced delays as the organization responded to the breach. Recovery efforts are ongoing, with some of the stolen funds already blocked.
The compromise occurred when attackers gained access to the bank through a platform used by an undisclosed service provider. They exploited this access to initiate fraudulent transfers from the bank’s own account to various financial institutions, potentially enabling them to convert the stolen assets into cryptocurrency. Arkéa has clarified that reports identifying their online subsidiary, Fortuneo, as the entry point for the attack are incorrect. Importantly, customer accounts across its networks and subsidiaries were not involved in the breach, underscoring that the theft originated directly from a bank account.
Analysis by blockchain investigator ZachXBT suggested that the actual amount stolen could be as high as €118 million, which translates to approximately $133 million. However, Arkéa has not confirmed this figure, only acknowledging a general estimate around €100 million, which remains a provisional assessment pending further investigation and recovery efforts.
In an update on November 6, Daniel Baal, president of the Confédération nationale du Crédit Mutuel, indicated that recovery of a portion of the funds had occurred, although specific amounts were not disclosed. The bank’s communication pointed out that, while they identified an external attack through a third-party platform, they did not attribute the breach to internal human error.
As a response to the incident, French prosecutors initiated an investigation, and Arkéa is collaborating with law enforcement and financial regulatory authorities, including the European Central Bank. They temporarily suspended certain transactions to mitigate the risk of further fraudulent activity but resumed most operations shortly after implementing additional security measures. The bank has stated that the financial repercussions of this event are not expected to jeopardize its overall health, with reported assets of €211.5 billion.
In the wake of the breach, Arkéa cautioned customers about potential phishing scams. They advised individuals to remain vigilant against communication purporting to be from the bank and to avoid sharing sensitive information like banking usernames and passwords. This precaution is important, especially since Arkéa has not confirmed any loss of customer information, focusing solely on the nature of the fraudulent transfers.
Experts in cybersecurity have raised concerns regarding the extent of supplier access and its implications for payment authorization. With the attack method yet to be detailed, industry professionals like Darin Fredde from Ridge Security advised caution in making assumptions about the specifics of the breach. He highlighted the need for thorough examinations of access controls within the payment chain, emphasizing that suppliers must adhere to the same security protocols as in-house systems. Waseem Ahmed of Secure.com echoed this sentiment, suggesting rigorous testing of supplier access to prevent unauthorized payments.
This incident emphasizes the necessity for robust security practices, especially in contexts where third-party suppliers possess access to critical financial systems. Leveraging the MITRE ATT&CK framework, possible tactics such as initial access, exploit public-facing applications, and credential dumping may have been leveraged during the breach, warranting a comprehensive review of security measures to safeguard against future incidents.