Crédit Mutuel Arkéa Confirms €118m Supply Chain Cyberattack

Crédit Mutuel Arkéa, a major French regional banking group, has confirmed it was the victim of a supply chain cyberattack that allowed unauthorised access to an internal account via a third-party service provider’s platform.

The breach, which was first identified on Monday by blockchain investigator ZachXBT, enabled attackers to transfer funds to other financial institutions. The group noted that the stolen funds may have subsequently been converted into cryptocurrency.

While the bank has not officially disclosed the exact total of the theft, it stated that the €118 million ($133 million) figure reported by the French newspaper Le Télégramme is accurate in terms of its order of magnitude. The group is currently working to assess the precise financial consequences of the incident.

Operational Response and Customer Safety

In response to the intrusion, the bank temporarily suspended certain transaction types to prevent further fraudulent activity. Operations began returning to normal on Wednesday following the implementation of additional security controls.

Crédit Mutuel Arkéa reassured its 5.8 million customers that their assets remain safe. The bank stated that the incident resulted in delayed execution of certain transfer operations but has had no direct impact on customer assets.

The group confirmed that some of the funds involved in the Crédit Mutuel Arkéa supply chain attack have been frozen, and recovery actions are currently underway.

Regulatory Concerns Over Supply Chain Risk

The incident highlights growing anxieties among European regulators regarding the security of the financial sector. As institutions become increasingly reliant on interconnected systems and external service providers, the potential for supply chain vulnerabilities to impact systemic stability has increased.

French law enforcement is currently investigating the breach to determine the identity of the attackers and the specific failings within the third-party provider’s platform.