French bank Arkéa says hackers used its own account to move funds

Hackers used the bank's own account to send fraudulent transfers, and customers' money was not touched, Crédit Mutuel Arkéa said Wednesday. The French cooperative banking group alerted its supervisors and temporarily suspended some transactions.

The attackers did not come in through Fortuneo, Arkéa's online bank. In a follow-up statement, the group said they entered through a supplier's platform and used Arkéa's own account to wire money to other banks. It called the attack "sophisticated," said it came from outside and ruled out an internal human error.

How much was taken is still unclear. A figure of 118 million euros has circulated, but Arkéa did not confirm it. It validated only the order of magnitude and said the amounts are still being assessed. Part of the money has been blocked, and the bank is working to recover the rest. It says the loss does not threaten its financial health.

For customers of Arkéa and Fortuneo, the group says "les avoirs des clients ne sont pas impactés," meaning client assets are unaffected. The only effect was that some transfers were executed late. Operations began resuming Wednesday morning.

Arkéa also warned of phishing, the fake emails and text messages that often follow an incident like this. It asked customers never to share logins, passwords, card numbers or SMS codes, and to check with their banking adviser if a message looks doubtful.

The case is a textbook example of third-party risk: a bank is only as secure as its suppliers, and here the bank itself was the direct victim. The group has floated the possibility that the funds were converted into cryptocurrency. It has not named the supplier, no link to other recent attacks has been established, and no group has claimed responsibility. Arkéa says it will share more as the assessment moves forward.