Hackers stole around $100 million from a French regional bank in a cyberattack that the bank says has now been contained.
Credit Mutuel Arkea said it was the victim of a cyberattack two weeks ago that hit its regional banking platform. According to the bank, the hackers gained access to an account belonging to the bank on an external payment platform and transferred money out of it into cryptocurrencies.
Reports have put the amount stolen at $133 million, but the bank would not confirm that figure. The headline figure given in the reports is around $100 million, and the exact sum has not been officially confirmed.
The bank said the incident had been contained and that no customer data was compromised. It added that there was no impact on its day-to-day operations and that the amount involved would not undermine its solvency.
Credit Mutuel Arkea has 550,000 customers and 1.4 billion euros in assets, according to the article. The bank is a regional lender, and the attack targeted its banking platform rather than its branch network.
The Paris prosecutor’s office has opened an investigation into aggravated fraud and money laundering by an organised gang, the reports said. No arrests have been announced in connection with the case so far.
Moving stolen money into cryptocurrency is a familiar pattern in large bank frauds, because digital assets can be moved across borders quickly and can be harder to trace than money held in ordinary bank accounts. Investigators in such cases typically work with payment platforms and cryptocurrency exchanges to follow the trail of the funds.
The attack underlines the scale of the threat facing even mid-sized banks. Financial institutions hold large sums and process payments around the clock, which makes them attractive targets for organised criminal groups that specialise in breaking into payment systems.
For the bank’s customers, the immediate message from the lender is that their accounts and personal data were not affected. The bank has said its daily operations are continuing as normal while the investigation proceeds.
What happens next will depend on the work of the Paris prosecutors and the investigators tracing the stolen funds. Recovering money that has been converted into cryptocurrency is often difficult, and such inquiries can take months before any charges are brought.
The case is likely to be watched closely by other regional banks in Europe, which face the same challenge of protecting payment systems that connect them to outside platforms. Regulators have repeatedly warned lenders to strengthen their defences against attacks that exploit links with third-party payment providers.
For now, the confirmed facts are the attack itself, the bank’s account of how the money was taken, the opening of a criminal investigation in Paris, and the bank’s assurance that its customers and its solvency are unaffected. Further details are expected as the investigation develops.
