By Mathieu Rosemain, Elizabeth Howcroft and Mateusz Rabiega
PARIS, Nov 5 (Reuters) – French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist and it was working to try to recover the money, in a rare case of cybercriminals successfully stealing from a mainstream bank.
The cyberattack, which was made public on Wednesday, follows the theft last week of $6.3 billion in cryptocurrency from Binance and a wave of cyberattacks targeting internet-connected fridges in Europe. French prosecutors said they were investigating the heist.
The attackers used an account belonging to Credit Mutuel Arkea to carry out “fraudulent transactions”, Credit Mutuel Arkea said in a statement on Wednesday. The funds were not in the form of cryptocurrency, the bank said, but could have been converted to crypto after being stolen.
Credit Mutuel Arkea temporarily suspended some transactions as a precaution, resulting in delays to some transfers, but said customer assets were not affected.
A spokesperson rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying that neither the division nor its customers’ accounts were involved.
Cyber experts told Reuters that while cyberattacks are common, it was unusual for money to be stolen virtually from a bank.
Rafay Baloch, CEO of cybersecurity and security engineering firm RedSecLabs, said the Credit Mutuel attack was unprecedented in Europe.
“We’re seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions,” he said.
FRANCE OPENS INVESTIGATION
The Paris prosecutor’s office said its cybercrime unit received a complaint from Credit Mutuel Arkea on Wednesday and immediately opened an investigation, led by France’s cybercrime police.
Credit Mutuel Arkea’s spokesperson declined to identify the third-party service provider whose platform was used in the attack and said it had informed the European Central Bank, French banking supervisors and prosecutors. France’s banking regulator, the ACPR, declined to comment.
While successful hacks of large financial institutions are rare, financial regulators globally have stepped up warnings about the risk of cyberattacks, particularly with the growth of AI.
“Any time you have a hit in the financial system, it’s a big deal,” said Puneet Kakkar, Managing Director at Nardello & Co in Paris.
Brittany-based Credit Mutuel Arkea is a French co-operative banking group with more than 5.8 million customers and €211.5 billion in assets. It is part of the wider Credit Mutuel banking network and is affiliated with its central body, while retaining significant strategic autonomy.
French banks typically have strong cybersecurity, due to regulatory requirements, said Kakkar. Still, he said, “cybercriminals are becoming more opportunistic and more creative”.
In 2016, attackers stole $81 million from the Bangladesh central bank account at the Federal Reserve Bank of New York. Millions of dollars’ worth of funds have also previously been stolen from banks in Russia and India during cyberattacks, Reuters has reported.
($1 = 0.8880 euros)
(Reporting by Mathieu Rosemain, Elizabeth Howcroft and Mateusz Rabiega; Editing by Tommy Reggiori Wilkes, Joe Bavier, Elaine Hardcastle)
