Tens of millions stolen from French bank Crédit Mutuel Arkéa: what we know

Banks are supposed to be among the best-protected places online. Yet hackers have just walked out of a French one with tens of millions of euros.

Crédit Mutuel Arkéa, the banking group behind Fortuneo, confirmed the attack on Wednesday 4 November. An investigation is under way.

What happened?

The group says it was hit by a "sophisticated attack from the outside". The attackers used the bank's own account to send money to other banks, so customers' savings were not touched, it says.

Some transfers were simply delayed. Almost all operations resumed on Wednesday morning, after extra security checks.

The amount is still unofficial. Specialists put it at 118 million euros (133 million dollars). The bank says it does not confirm that figure and can only validate the order of magnitude: several tens of millions. Part of the money has been blocked, and efforts to recover the rest are continuing.

How did they get in?

That's the big mystery. Early theories online pointed to an infected device belonging to an employee or contractor. The bank rules out "human error" and says the attackers came through the platform of one of its service providers, not through Fortuneo. It gave no further detail.

The stolen money was then converted on crypto exchanges and split across more and more wallets. Kraken says it restricted accounts suspected of being involved, and Crypto.com says it acted to stop funds linked to the incident from passing through it.

Cybersecurity expert Gabriel de Brosses called it an attack of "unprecedented scale" and said alarms "should have sounded". In his view, the attackers know banking procedures very well.

What's next?

The Paris prosecutor's cybercrime unit opened an investigation on Wednesday after the bank filed a complaint. It covers organised attacks on an automated data processing system, and the Ofac (France's anti-cybercrime office) is leading it.

The bank mentioned no data theft. Still, it warns customers to watch out for phishing, meaning fake messages pretending to come from the bank.