Arkéa says cyberattack used provider platform for transfers

Crédit Mutuel Arkéa said attackers used an unnamed service provider’s platform to reach the French banking group and make fraudulent transfers from one of its own accounts to other financial institutions. The bank said customer assets were not affected, while the exact financial loss and any conversion of funds into cryptocurrency remain unconfirmed. Arkéa said on November 4 that it could validate only the order of magnitude of reported losses, put at roughly €118 million to €133 million. It did not confirm a final amount. Some funds had been blocked, and recovery efforts were continuing, the bank said. The total transferred is not necessarily the bank’s ultimate loss after blocked funds and any recoveries are accounted for. The bank said attackers reached it through a service provider’s platform, but did not identify the provider or explain how access was gained. It rejected reports that the attackers entered through Fortuneo, its online-banking subsidiary, and denied that the incident involved customer accounts. Arkéa also rejected suggestions that an employee mistake caused the attack, according to the bank’s statements. The group said it temporarily halted some...