Crédit Mutuel Arkéa is seeking to recover funds diverted in a cyberattack disclosed on 4 November. According to details provided to Reuters on 5 November, around €100 million was stolen. The bank says its customers’ funds have not been affected. Some transactions were nevertheless delayed while protective measures were put in place.
The case therefore affects two different aspects of banking: money held by the institution for its own account, targeted by the fraudulent transfers, and services used by its customers, which were temporarily disrupted. This distinction explains why a transfer may have been delayed without the account holder’s balance being emptied.
Customers’ accounts were not used in the diversion
In its statement of 4 November, Arkéa acknowledges fraudulent transactions and describes a precautionary suspension of some payments. It said services would resume in the morning, after checks and stronger safeguards.
The bank distinguishes the funds affected from the deposits of individuals and businesses. It says the impact on customers was a delay in processing some transfers. This statement applies to its federations and subsidiaries; it does not mean that all their services were interrupted.
Customers may find it useful to check the status of an expected transaction in their usual online banking space. A pending transaction is not the same as an unrecognised debit. If a transaction appears abnormal, they should contact their adviser using a channel they already know, rather than using a number received in a message referring to the attack.
Funds transferred to other banks
The scenario made public involves the use of an account belonging to Arkéa to transfer funds to other institutions. Conversions into cryptocurrencies were subsequently mentioned. This was not initially a hack of a cryptocurrency wallet held by customers.
AFP reports that some of the money may have been blocked and that efforts to recover it are under way. The agency also says the bank has ruled out simple human error and describes an external intrusion. These details come from the institution, not from a public technical report on the attack.
The amount diverted and the final loss are therefore not the same thing. The former describes the fraudulent transfers identified; the latter will depend in particular on how much can be recovered. The information available does not yet make it possible to establish a definitive financial toll.
Investigation opened in Paris
Reuters reports that the Paris prosecutor’s office received the bank’s complaint on 4 November and opened an investigation entrusted to specialist cybercrime services. A service provider is mentioned as part of the route used by the attackers, but Arkéa has not made its identity public.
This reliance on an external service is an important aspect of the investigation. However, it is not enough to identify the vulnerability exploited, any credentials that may have been compromised or the respective responsibilities. Nothing in the information consulted makes it possible to attribute the operation to a specific group.
AFP specifies that the investigation concerns an attack on an automated data processing system committed by an organised group. The existence of an investigation establishes that the judicial authorities are involved; it does not identify the perpetrators or provide conclusions about the precise mechanics of the diversion.
Caution is also needed with messages received
In its warning to customers, Arkéa points out that a highly publicised attack may be followed by phishing attempts. An email or call claiming to help secure an account may exploit the anxiety caused by the incident.
The bank reminds customers not to share their login details, passwords, card details or verification codes received by SMS. If in doubt, it recommends contacting their adviser directly. The urgency claimed in a message is no reason to skip this check, even if the person contacting them knows the bank’s name or mentions the cyberattack.
The next update should set out the sums recovered and the findings of the investigation. For the institution, the challenge is both to recover the funds and to understand the route taken in the attack. For customers, the information to watch is how their transactions are working and communications from their usual contacts.
File photo: Crédit Mutuel Arkéa headquarters in Le Relecq-Kerhuon in 2023. Focale fixe / FJaffres / Wikimedia Commons / CC BY-SA 4.0.
