Key takeaway: Merchants, processors and fintechs should treat any third-party platform with access to internal accounts as a direct fraud exposure. The reported attack ran through a vendor, so vendor access controls and monitoring of outgoing transfers belong in the fraud program.
French banking group Crédit Mutuel Arkéa said Thursday that hackers stole around €100 million ($112.61 million). The attackers reached an internal account through an unnamed third-party provider’s platform, according to Reuters and CSO Online.
The attackers transferred the funds to other financial institutions, CSO Online reported. The bank said the stolen money was not in cryptocurrency, though the attackers could have converted it to crypto afterward. Le Télégramme reported the figure was above €118 million, according to CSO Online. The bank would not confirm the exact figure. It said the order of magnitude was accurate and that it was still assessing the final financial impact.
The bank said it temporarily suspended some transactions, delaying certain transfers, but that the suspension did not affect customer assets. CSO Online reported that the bank has frozen some funds and is working to recover the rest. The bank informed the European Central Bank, French banking supervisors and prosecutors. The Paris prosecutor’s office said its cybercrime unit received a complaint from the bank on Wednesday. France’s cybercrime police opened an investigation.
A spokesperson rejected media reports that the online banking subsidiary Fortuneo was the entry point. The spokesperson said the hack did not involve the division or its customers’ accounts, and declined to name the third-party provider. CSO Online described the incident as a supply chain attack.
Cyber experts told Reuters that it is unusual for money to be stolen virtually from a bank. “Any time you have a hit in the financial system, it’s a big deal,” said Puneet Kakkar, managing director at Nardello & Co in Paris. Crédit Mutuel Arkéa has more than 5.8 million customers and €211.5 billion in assets, according to Reuters.
Why it matters: The reported attack path, through a third-party provider’s platform, shows that a vendor connection can give attackers access to internal accounts. The funds moved to other institutions and could have moved into crypto, so recovery now depends on how quickly banks flag the transfers. Merchants, processors and fintechs that give vendors access to payout or settlement accounts should review that access. They should monitor outgoing transfers as closely as customer-facing activity.
Sources: Reuters via Insurance Journal, and CSO Online