Crédit Mutuel Arkéa chair details €100M heist via fake Fortuneo IBANs

The chair of Crédit Mutuel Arkéa has given the first detailed account of how attackers took about €100 million from the French bank's own account this month. In an interview with AFP, published by BFM on Friday, chair Julien Carmona said the attackers used material taken from a compromised service provider to get into the bank's systems, generated fake IBANs for its online bank Fortuneo, and used them to send instant payments out of Arkéa's own account to accounts at other European banks.

Carmona called it "a new kind of heist" by "a very well organised, very well equipped criminal group", and said it was "very probably aided by advanced artificial intelligence". He gave no evidence for the AI claim, and said the bank has had no claim of responsibility from the attackers. We reported the attack when the bank disclosed it on 4 November.

How the attack unfolded

Carmona's timeline starts a week before the theft. On 27 October the bank found signs that a service provider's systems had been breached. It cut the connection between its own systems and the provider's and reported it to the authorities, but "nothing allowed us to detect" that material had been taken from the provider that could later be used to get into Arkéa's own systems, he said.

The fraudulent payments began on Sunday 1 November. The fake Fortuneo IBANs were used to trigger payment orders from the bank's own account through instant payment systems, which by design carry fewer checks than ordinary transfers, and everything was done to make the transfers look legitimate, Carmona said. The money went to real accounts at other European banks that the fraudsters had opened in advance, which he said shows the attack was "prepared long in advance". On-chain investigators later traced much of it to crypto exchanges, as ZachXBT reported at the time.

The bank says it only grasped the scale of the attack, and that it involved fraudulent transfers, on the morning of Tuesday 3 November. It then cut all external access to its systems and its access to the interbank payment system, removed the fake accounts and changed all authentication credentials, before announcing the attack the next day. In its 4 November statement it said the attackers had come in through a provider's platform, not through Fortuneo.

The loss and recovery

Carmona put the loss at about 1% of the group's equity, or a quarter's earnings, and said the bank's solidity is not affected. Arkéa has not published a final figure because it hopes to recover part of the money: some banks and crypto platforms delayed transfers and froze funds, some has already been recovered, and talks on the rest are under way. The bank is also in talks with its insurer. Crypto analysts had flagged unusual flows to exchanges on 1 and 2 November, but Carmona said that no one at the time linked them to Arkéa.

What is not known

Arkéa has still not named the service provider, said what was taken from it, or explained how stolen material from a third party let the attackers create IBANs and issue payments from the bank's own account. The Paris prosecutor's cybercrime investigation is continuing.