Crédit Mutuel Arkéa Says Third-Party Platform Was Entry Point, Denies Fortuneo Link

Crédit Mutuel Arkéa said Nov. 4 that attackers gained access through a third-party provider’s platform and used the French banking group’s own account to send money to other financial institutions.

Arkéa denied that Fortuneo, its online banking brand, was the point of entry. It said the money may have been converted to cryptocurrency through specialized platforms, while customer assets were unaffected.

The group did not confirm the specific estimate of about $133 million, but said it was within the right order of magnitude. Some funds have been frozen, and Arkéa is still assessing its final loss.

The service provider was not named, and the disclosure did not identify the receiving institutions. It also did not give a final loss figure while the bank’s assessment continues.

Arkéa had previously confirmed an attack tied to fraudulent transactions without disclosing its final financial exposure. The latest statement adds detail to that confirmation, including the access route and the possibility that funds were converted to cryptocurrency.