Crédit Mutuel Arkéa Says Hackers Took About €100 Million From the Bank's Own Funds

The bank disclosed the attack on Wednesday and said it had been "contained". According to AFP, the intruders got into Arkéa's own account and sent transfers to other banks. Customer accounts were not touched and customers lost nothing, the bank said. It ruled out human error and called the breach "a sophisticated attack coming from the outside", but has not said how the attackers got in or who they might be.

Thefts of this size from a mainstream lender are rare. Most large cyber heists of the past decade have hit crypto exchanges, payment networks or banks in emerging markets with weaker controls. Arkéa's loss shows that the transfer systems of an established eurozone bank can be used to move nine-figure sums before anyone stops them.

The Seoul Economic Daily, citing reports, said the attackers broke in by compromising the computer of a third party that had authority to make transactions. It also said US crypto exchange Kraken spotted an unusually large inflow from a European bank, raised an alert on November 3 and blocked transfers that were still going through. Arkéa said part of the stolen money has been frozen and that it is working to recover the rest.

The final figure is not settled. The French newspaper Le Télégramme put the loss higher than €100 million. ZachXBT, an independent blockchain investigator who first exposed the theft on social media earlier in the week, said the funds were spread across accounts at several crypto exchanges. He said North Korea was not behind the attack, according to the reports. The bank has confirmed the scale of the loss but not a precise number. It said the amount is still being assessed and will not threaten its financial strength. Arkéa reported net profit of €230 million for the first half of the year.

The theft follows a run of cyberattacks in Europe in recent weeks. Semafor counted an attack on France's blood banks and a hack of supermarket refrigeration systems that affected 10 countries among them. US agencies have since warned that attacks on industrial refrigeration equipment are continuing.

Regulators in several countries have recently told companies to strengthen their defences. Some officials worry that AI tools will raise both the number and the scale of attacks. Semafor cited a survey that linked 84% of recent ransomware attacks to AI. It also quoted the head of the Dutch cybersecurity agency: "There are three things that you have to do right now. And that's patch, patch, and patch."

The Paris prosecutor's investigation aims to identify the group behind the attack and trace the funds. Arkéa has not said when it expects to have a final loss figure or whether the external service provider has been identified.