Crédit Mutuel Arkéa Says €100M Cyberattack ‘Very Likely’ Aided by AI

In a Nov. 12 interview with AFP, Crédit Mutuel Arkéa chairman Julien Carmona described last week’s cyberattack as unprecedented “in terms of sophistication” and “technicality.” He said it was “very likely aided by advanced artificial intelligence,” but he did not explain how AI was used.

Chairman Calls It a New Heist

Carmona called the episode a “heist of a new kind,” carried out by “a very well organized, very well equipped, very well tooled criminal group.” No one has claimed responsibility, he said.

He put the financial impact at “around a hundred million euros,” or about 1% of the group’s equity, the equivalent of a quarter’s earnings. The bank’s solidity, he said, “is absolutely not affected.”

Fake IBANs, Instant Payments

Attackers generated fake IBANs for Fortuneo, the group’s online bank, and used them to trigger payment orders from Crédit Mutuel Arkéa’s own account through instant payment systems. Those systems have “fewer controls than classic transfers,” Carmona said.

The transfers began on Sunday, Nov. 1, with “everything done to circumvent controls, to make these illegitimate transfers look legitimate.” The money went to real accounts at other European banks that the fraudsters had opened themselves, then on to crypto platforms.

The bank discovered the scale of the fraud on the morning of Tuesday, Nov. 3, and cut all external access to its information system and its link to the interbank payment system. Carmona told Les Echos that Fortuneo’s systems, and therefore its customers, were not affected.

Attackers Used a Service Provider

On Oct. 27, the bank detected signs that a service provider’s system had been compromised, cut the connection and notified the authorities. At that point, Carmona said, nothing showed that material taken from the provider would later be used to enter Arkéa’s own systems.

The bank has not named the provider.

Bank Disclosed the Loss

Crédit Mutuel Arkéa disclosed the attack on Nov. 4, saying around €100 million was missing from the bank’s own account and that customer accounts were not used. Paris prosecutors opened an investigation after a complaint from the bank that day.

Some transfers have been held or frozen, and Carmona said part of the funds had been recovered, with talks continuing over the rest. The bank is also in discussions with its insurer.

The case follows other recent cyber incidents in France, including attacks that disrupted supermarket refrigeration and blood storage sites.