Key points

• Crédit Mutuel Arkéa said on Wednesday, November 4, that a cyberattack enabled fraudulent transactions at the bank.
• The bank says customers’ assets were not affected and that no customer will suffer a financial loss.
• It temporarily suspended certain transactions, and says operations are resuming after final security checks.
• Media reports put the amount stolen at about €118 million ($133 million). Arkéa has not confirmed that figure and says the amounts are still being assessed.

What happened

Crédit Mutuel Arkéa, the Brest-based banking group that includes Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest, said it was the target of a cyberattack that allowed fraudulent transactions. The bank said the incident is now under control and that it had suspended certain transactions to secure operations and prevent further fraudulent movements. It said the attack delayed the execution of some transfers.

The fraud was first made public earlier this week by ZachXBT, an independent investigator who tracks cryptocurrency flows. According to AFP, he said the stolen funds were routed through several accounts at crypto exchanges. Bloomberg reported that the attackers broke into the bank’s IT networks and took money from the bank. The €118 million figure was reported by the regional newspaper Le Télégramme and relayed by AFP.

Arkéa declined to give a total. It told Le Parisien that some funds had been frozen, and said the final amounts would not undermine its financial strength.

Are customer accounts safe?

According to Arkéa, yes: customers’ assets were not affected, and the bank says no customer will bear a loss. The main visible impact so far is delayed transfers. Some payments are being executed late rather than on the usual timeline.

What customers should do

• Don’t resend a delayed transfer. Sending it twice could cause a duplicate payment. If a delay cost you fees, contact your branch or Arkéa’s customer service.
• Watch for phishing. Arkéa has warned that phishing attempts are possible in the wake of the attack. Don’t click links in unexpected texts or emails claiming to be from the bank, and never share codes or passwords.
• Keep two-factor authentication on and check your statements for anything unfamiliar.

What we still don’t know

• The exact amount stolen and how the attackers got in.
• Whether any customer data was exposed. Arkéa has not reported a data breach, but its statement doesn’t address the question directly.

Sources: Arkéa statement of November 4 as reported by AFP, Bloomberg, Euronews, and Quartz.