Credit Mutuel Arkea Says Hackers Stole €100 Million From Its Accounts

Hackers stole roughly €100 million ($112.61 million) from French lender Credit Mutuel Arkea, the bank said on Thursday, calling it a rare case of cybercriminals successfully draining money from a mainstream bank.

The bank disclosed the heist on Wednesday and said it's working to recover the funds. The attackers used an account belonging to Credit Mutuel Arkea to carry out "fraudulent transactions," the bank said in a statement. The stolen funds weren't cryptocurrency, though the bank said they could have been converted to crypto after the theft.

The attack landed in a busy week for cybercrime. Last week, thieves stole $6.3 billion in cryptocurrency from Binance, and a separate wave of attacks targeted internet-connected fridges across Europe. French prosecutors said they're investigating the Credit Mutuel Arkea case.

What happened to customer accounts?

Credit Mutuel Arkea temporarily suspended some transactions as a precaution, causing delays to some transfers. Customer assets were not affected, the bank said.

A spokesperson also rejected media reports that Fortuneo, the bank's online banking subsidiary, was the entry point. Neither that division nor its customers' accounts were involved, the spokesperson said.

Cyber experts told Reuters that while cyberattacks are common, stealing money virtually from a bank is unusual. Rafay Baloch, CEO of cybersecurity and security engineering firm RedSecLabs, said the Credit Mutuel attack was unprecedented in Europe.

"We're seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions," Baloch said.

Who is investigating?

The Paris prosecutor's office said its cybercrime unit received a complaint from Credit Mutuel Arkea on Wednesday and immediately opened an investigation, led by France's cybercrime police.

The bank's spokesperson declined to name the third-party service provider whose platform was used in the attack. The bank said it has informed the European Central Bank, French banking supervisors and prosecutors. France's banking regulator, the ACPR, declined to comment.

How rare is a bank heist of this size?

Successful hacks of large financial institutions are rare, but financial regulators globally have stepped up warnings about cyberattack risk, particularly as AI use grows.

"Any time you have a hit in the financial system, it's a big deal," said Puneet Kakkar, Managing Director at Nardello & Co in Paris.

Kakkar noted that French banks typically have strong cybersecurity due to regulatory requirements. Still, he warned: "cybercriminals are becoming more opportunistic and more creative."

There's precedent for losses at this scale. In 2016, attackers stole $81 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York. Millions of dollars have also been stolen from banks in Russia and India during earlier cyberattacks, Reuters has reported.

What's at stake for the bank?

Credit Mutuel Arkea is a Brittany-based French co-operative banking group with more than 5.8 million customers and €211.5 billion in assets. It forms part of the wider Credit Mutuel banking network, is affiliated with its central body, and retains significant strategic autonomy.

The €100 million loss represents a small fraction of the group's balance sheet, but the reputational stakes are larger. With prosecutors, the ECB and French supervisors now involved, the investigation's findings on the unnamed third-party provider will shape how European banks weigh outsourcing risk in their payment chains.