Arkéa says attackers came in through a supplier and acknowledges the scale of 118 million

Crédit Mutuel Arkéa has stated in a questions-and-answers note dated November 4 that the attackers went through the platform of one of its suppliers and so reached the bank directly, and has ruled out that the entry came through its subsidiary Fortuneo. According to the note, the attackers used the group's own account to make transactions to other banking players, which potentially allowed them to convert the money into cryptocurrency.

Asked whether it confirms that 118 million euros, equivalent to 133 million dollars, were stolen, the bank replies that it does not confirm that information and can "validate the order of magnitude". It adds that some of the funds may have been blocked and that the amounts do not call its financial soundness into question. The 118 million figure comes from blockchain fraud investigator ZachXBT, according to BleepingComputer, which published the case on November 7.

The bank says the incident has no consequences for customers other than delayed execution of some transfers, rules out human error, and is working with judicial and police authorities to determine the origin and method of the attack.

Developing story: the final amount, which the bank says it cannot yet give, is still missing, and neither the supplier through which the attackers entered nor the perpetrators have been identified.