€150 Million Vanishes From French Bank as Hackers Exploit Unknown Route

€150 Million Vanishes From French Bank as Hackers Exploit Unknown Route
Crédit Mutuel Arkéa, one of France’s major banking groups, said it was hit by a cyberattack that enabled fraudulent transfers and drained at least €150 million over several days.

The bank said the attackers targeted funds belonging to its online banking subsidiary Fortuneo rather than customers’ accounts. Depositors therefore faced no direct loss, according to the available account of the incident. The bank also temporarily suspended some transactions as a precaution while it worked to secure its operations.

“Our teams reacted immediately as soon as the attack was detected and, as a precaution, decided to temporarily suspend certain transactions to ensure business continuity and prevent further unauthorized transfers.”

The stolen money was allegedly moved through transfer orders issued from Fortuneo’s accounts. Investigators and financial journalist Grégory Raymond said the attackers could select the recipient’s name themselves, allowing funds to be sent to accounts belonging to users anywhere in the world while displaying an arbitrary beneficiary name.

The precise entry point remains unknown. Initial assessments have compared the method with techniques used in the attack on cryptocurrency exchange Binance, though Raymond also raised the possibility of an internal security failure. One theory is a form of CEO fraud, in which an attacker impersonates a senior executive to persuade an employee to authorize payments or provide access to protected resources.

The bank said the situation was under control, but the investigation into how the attackers penetrated its systems and whether any insiders were involved remains ongoing.