French banking group hit by supply chain cyberattack

French regional banking group Crédit Mutuel Arkéa admitted Wednesday that attackers had accessed an internal account via an unnamed third-party service provider’s platform and transferred funds to other financial institutions. Those funds, it said, could have then been potentially converted to cryptocurrency by the thieves. The day before, cryptocurrency news outlet CoinDesk reported that the attack had been detected on Monday by blockchain investigator ZachXBT, although at the time he did not identify the entity involved. On Wednesday, he identified the suspected victim as Crédit Mutuel Arkéa, which the banking group later confirmed. It did not, however, specify whether the stolen funds were originally in traditional currency or cryptocurrency. This attack comes amidst worries by European regulators about cyber threats to financial institutions as they become more reliant on interconnected systems and external service providers. The bank, which serves the West of France, temporarily suspended some transactions in the wake of the attack to prevent further fraudulent activity. It reported that, as of Wednesday morning, operations were returning to normal after the implementation of additional security controls. French law enforcement is investigating the breach. In its initial announcement, the group reassured customers that their funds were safe. “This incident has no impact on [customer] assets, and has only resulted in a delayed execution of certain transfer operations. Their interests are fully protected, and safeguarding their assets is an absolute priority,” it said. French regional newspaper Le Télégramme reported that the thieves had taken over €118 million (over $133 million); the bank would not confirm the amount but said that the order of magnitude was accurate. The bank said it was still working to assess the precise financial consequences of this attack. “Some of the funds involved have been frozen, and other actions are underway to recover them. While it is therefore still too early to provide a final figure, we can already confirm that the amounts involved are in no way likely to jeopardize the financial health and stability of Crédit Mutuel Arkéa,” it said. The group has 5.8 million customers and manages more than €211 billion (about $237 billion) in assets.