Attackers reportedly exploited a third-party provider to drain the lender’s accounts and funnel stolen funds through other banks
Hackers have stolen around €100 million from French banking group Credit Mutuel Arkea in a sophisticated cyberattack, the lender has confirmed. The attackers exploited a third-party service provider to siphon money into other bank accounts, with some of the funds potentially converted into cryptocurrency.
Blockchain investigator ZachXBT initially estimated the theft at more than $106 million before identifying another $27 million in suspicious withdrawals, bringing the total to over $133 million. In a statement on Wednesday, Crddit Mutuel Arkea acknowledged the scale of the attack but declined to confirm the exact amount stolen.
The hackers reportedly gained access through a compromised external service provider and used the bank’s own account to carry out fraudulent transfers to other financial institutions. The money was then moved through multiple accounts, with investigators examining possible conversions into cryptocurrency.
The bank described the breach as “a sophisticated attack coming from the outside,” saying it was not caused by human error. It has not disclosed how long the attackers had access to its systems or how many fraudulent transactions were carried out.
French prosecutors have launched an investigation into what they described as an “attack on an automated data processing system by an organized group.” No suspects have been publicly identified, and the authorities have not established who was behind the operation.
Credit Mutuel Arkea said it had blocked some of the stolen funds and was working with other financial institutions to recover the money. The lender maintained that customer accounts had not been affected.
The massive bank heist comes just days after hackers targeted refrigeration systems at three regional blood banks in France, part of a wider wave of cyberattacks that has hit hundreds of supermarkets across Europe.
The French Health Ministry confirmed on Wednesday that hackers had compromised systems controlling blood-storage refrigerators overnight on November 2, Reuters reported. Staff managed to save the blood supplies by moving them to backup units disconnected from the network.
The wave of attacks began in France in October, when hackers tampered with refrigeration systems at around 700 supermarkets, according to French Finance Minister Roland Lescure. A fresh wave struck on Monday, hitting retailers in at least nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden.
Hackers reportedly forced refrigeration units into defrost mode, sending temperatures soaring to as high as 50C (122F) and leaving stores with large quantities of spoiled food. In Belgium alone, around 75 supermarkets were affected.
No link between the bank theft and the refrigeration attacks has been established.
