Hackers stole around €100 million from Crédit Mutuel Arkéa through a supplier platform. Customer funds were unaffected, and…

French Bank Crédit Mutuel Arkéa says hackers exploited a service provider to steal up to $133 million using the bank’s own account.

French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that let attackers make fraudulent transactions of up to $133 million, forcing it to suspend certain systems. Crédit Mutuel Arkéa is a major French cooperative banking and insurance group headquartered in Brest, Brittany, France.

The bank says the attacker used its own account to send transactions to other banking organizations, and that customer assets weren’t affected.

“French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist and it was working to try to recover the money, in a rare case of cybercriminals successfully stealing from a mainstream bank.” Reuters states.

Blockchain researcher ZachXBT first warned of a large unauthorized withdrawal from multiple centralized exchange accounts a day earlier. He said the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as the USDC and USDT stablecoins.

“Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.” ZachXBT wrote.

“While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.”

The attacker remains unidentified, but ZachXBT believes it is highly unlikely to be Lazarus Group, based on money-laundering patterns.

According to BleepingComputer, the expert pointed out that the lack of public disclosure allowed attackers to launder $30 million by November 3, potentially preventing EU authorities from freezing the funds. The Paris prosecutor’s cybercrime unit opened an investigation after receiving a complaint from Crédit Mutuel Arkéa, with France’s cybercrime police leading the probe.

Arkéa disclosed the incident on November 4, saying it was contained, customer assets were unaffected and some transfers had been delayed. Attackers reportedly accessed the bank through a service provider’s platform, not Fortuneo, and used Arkéa’s own account to move funds through other banks and convert them into cryptocurrency. The bank also warned customers about increased phishing risks.

“Crédit Mutuel Arkéa announces that it has been the target of an attack that enabled the execution of fraudulent transactions.” reads the notice published by the bank. “Upon detecting this attack, and in accordance with standard procedures, the Group contacted the relevant regulatory and supervisory authorities to inform them of the situation.” “This incident is now closed and fully under control. Operations are gradually resuming this morning, following thorough verification by the Group and its subsidiaries and the implementation of enhanced security measures.”

Crédit Mutuel Arkéa says customer assets were unaffected, although some transfers were delayed. The bank maintains its financial stability, warns of possible phishing attempts and urges customers not to share sensitive information. Its teams are assessing the incident and strengthening security measures, with further updates expected.

Arkéa did not confirm ZachXBT’s reported figure but acknowledged significant losses and said some funds were blocked. The bank ruled out internal human error, described the incident as a sophisticated attack and is working with law enforcement to identify the attackers and establish how the breach occurred.

When the FAQ asked whether 118 million euros had been stolen, Arkéa wouldn’t give a number: We do not confirm this information and can only validate the order of magnitude.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Crédit Mutuel Arkéa)

Until this week, the wave of refrigeration cyberattacks sweeping Europe looked like a supermarket problem. That changed when France's national blood service confirmed that temperature controls had been altered at three of its sites. Blood products stored for hospitals were suddenly at risk, and the attackers had not even targeted the organisation directly. The Établissement Français du Sang (EFS) said "temperature and defrosting thresholds were raised to very high levels" in its cold storage rooms. These rooms hold blood products at preparation and distribution sites before they go to healthcare facilities, along with samples for biobanks. The outcome was far better than in the supermarkets. "No health impacts have been identified and no losses of blood products have been reported," the EFS said in a statement on Tuesday.

How the Refrigeration Cyberattacks Reached Blood Storage

The EFS says it was not targeted directly. Like many of the affected retailers, it says the attack reached it through a third-party provider of refrigeration equipment. That detail explains why a blood service ended up on the same list as supermarkets. If attackers can get into a shared supplier's systems, any organisation using that equipment may be exposed, whatever its sector. This is the first reported case in France in the second wave of attacks on control systems, and the first reported to affect a healthcare organisation.

Why the Blood Supply Survived When Food Did Not

The difference came down to how quickly someone noticed. "The EFS's monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised," the organisation said. Depending on the situation, affected equipment was either brought under control without impacting the products, or shut down. Products in the affected cold rooms were moved to other facilities as a precaution. Compare that with the first wave in France in October. Attackers remotely defrosted fridges in hundreds of supermarkets, reportedly by triggering a forced defrost option, and pushed temperatures as high as 50 degrees Celsius. They struck while stores were closed, so the heat went unnoticed for hours. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. Reporting on that wave found the attackers had targeted ageing, internet-connected devices still online years after their manufacturer stopped supporting them.

How Far the Refrigeration Cyberattacks Have Spread

The second wave is wider than the first. Businesses in at least 11 countries have reportedly been affected: Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom. Earlier this week, supermarket chains in Sweden, Belgium, Luxembourg, Ireland and Estonia reported fridges and freezers set to high temperatures, with several discarding food. In Estonia, where the intrusion was caught within minutes, there was no significant damage.

Who Is Behind It?

No one knows for sure, and no group or entity has claimed responsibility for the attacks. It is also unclear whether the same people are behind both waves. Rumours have spread online that two Russian hacktivists groups, Noname057(16) and Z-Pentest Alliance, posted that they had hacked Danfoss. That led to speculation that they were behind the freezer attacks. Analysts now question whether that claim means they were responsible. Russian groups have not been ruled out. However, experts say Iranian hacktivists, nation-state hackers, or even teenagers pulling pranks could also be the culprits.

A French Bank Reports a Separate Attack

In the same week, Crédit Mutuel Arkéa in northwestern France said it had halted some services after a cyberattack enabled fraudulent transactions. Nothing in the bank's statements links the incident to the refrigeration attacks. However, the bank describes a similar entry point: attackers "used the platform of one of our service providers" to reach the bank directly. The bank said attackers used its own account, not customer accounts, to make transactions to other banks. That potentially let them convert the money into cryptocurrency through specialised platforms. It denied press reports that the attackers got in through its subsidiary Fortuneo, and said human error was not the cause. Asked whether 118 million euros was stolen, the bank said it could not confirm the figure and could "only validate the order of magnitude." Some funds have been frozen and recovery efforts are under way. The bank says the losses will not threaten its financial stability and that customers' assets were not affected, apart from delays to some transfers. Almost all operations have resumed. The bank has also warned customers about a likely rise in phishing attempts, urging them never to share passwords, card numbers or SMS validation codes. The refrigeration attacks and the bank attack have not been tied to the same attackers. What they share is the route in. In both cases, the organisations say they were reached through an outside provider rather than through their own systems. Neither the blood service nor the bank was the first door the attackers opened.