There were no masks, no drills and no getaway car, yet a regional French bank has lost more money in one go than most classic robberies ever netted. Crédit Mutuel Arkéa, the cooperative group behind Crédit Mutuel in Brittany and the south-west, admitted on Wednesday that attackers had stolen more than €100 million. Local paper Le Télégramme put the figure at about €118 million; the bank would not confirm the exact sum but accepted the order of magnitude.
The method is what has alarmed the industry. Instead of emptying customer accounts, the intruders went straight for the bank’s own account, wiring funds to other banks and then swapping the money into cryptocurrency on specialised exchanges. Arkéa says the way in was the platform of one of its suppliers, not its online brand Fortuneo as some reports had claimed, and it insists no staff error was involved, calling it a sophisticated outside job.
Customers mostly noticed an app that stayed dark for hours and transfers that were paused as a precaution and went through late. The bank stresses that savings were never at risk and that its finances remain sound. Part of the money has already been frozen and work to recover the rest is ongoing.
Paris prosecutors opened an investigation into organised intrusion into an automated data system after the group filed a complaint, with France’s anti-cybercrime office handling the case. Security specialists quoted in French media called the theft unprecedented for a European bank and warned that the stolen funds were split into many small chunks, which makes tracing them very hard. The timing is awkward too: only weeks ago Arkéa collected an award for innovation in cybersecurity.
