French Bank Arkéa Hit by 'Sophisticated Attack,' $133 Million Reportedly Stolen via Supplier Compromise
French banking giant **Crédit Mutuel Arkéa** has confirmed it was the target of a "sophisticated attack" that reportedly led to the theft of an estimated $133 million. The breach, which compromised an unnamed third-party supplier, allowed attackers to initiate transfers using the bank's own accounts, though **Arkéa** stresses that customer funds remain safe.
A significant cyber incident has shaken the financial sector, with French banking firm **Crédit Mutuel Arkéa** confirming a "sophisticated attack" that reportedly resulted in the theft of approximately $133 million.
### Supplier Compromise Leads to Direct Access
**Crédit Mutuel Arkéa** stated in a press notice that attackers gained access not through its online banking subsidiary **Fortuneo**, as initially speculated by some local reports, but by compromising an unnamed service provider's platform. This provided the attackers with direct access to the banking group's internal systems.
Once inside, the threat actors reportedly used **Crédit Mutuel Arkéa**'s own accounts to execute transactions to other banking institutions. These funds were then potentially converted into cryptocurrency via specialized platforms.
### Blockchain Investigator Uncovers Details
The incident first came to light through **ZachXBT**, a pseudonymous American blockchain investigator. **ZachXBT**'s initial reports on Monday detailed withdrawals from cryptocurrency exchange accounts and subsequent laundering attempts, estimating the total theft at over $133 million.
**Arkéa**, while declining to confirm the exact figure, acknowledged that the reported amount was of the "order of magnitude" of the loss. The bank emphasized that the incident was not a result of human error, underscoring its sophisticated nature.
### Customer Funds Secure, Recovery Efforts Underway
Crucially, **Crédit Mutuel Arkéa** has stressed that customer accounts were not directly accessed, and customer assets remain unaffected. The bank also clarified that the sum, while substantial, is "absolutely not of a nature" to threaten its solvency or financial health, given its total assets exceed £237 billion.
"As soon as the attack was detected, the necessary measures were taken under existing crisis procedures. The incident is now under control," the bank stated. They also reported that some of the converted assets have been frozen, and efforts are underway to recover the remaining funds.
**Arkéa**'s security systems reportedly identified the suspicious activity quickly, allowing for containment measures to be implemented. The bank is currently collaborating with judicial and police authorities to pinpoint the exact origin and modus operandi of the attack.