The attackers used an account belonging to Credit Mutuel Arkea to carry out “fraudulent transactions,” Credit Mutuel Arkea said in a statement on Wednesday. The funds were not in the form of cryptocurrency, the bank said, but could have been converted to crypto after being stolen.
French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist and it was working to try to recover the money, in a rare case of cybercriminals successfully stealing from a mainstream bank.
The cyberattack, which was made public on Wednesday, follows the theft last week of $6.3 billion in cryptocurrency from Binance and a wave of cyberattacks targeting internet-connected fridges in Europe. French prosecutors said they were investigating the heist.
The attackers used an account belonging to Credit Mutuel Arkea to carry out “fraudulent transactions,” Credit Mutuel Arkea said in a statement on Wednesday. The funds were not in the form of cryptocurrency, the bank said, but could have been converted to crypto after being stolen.
Credit Mutuel Arkea temporarily suspended some transactions as a precaution, resulting in delays to some transfers, but said customer assets were not affected.
A spokesperson rejected media reports that its online banking subsidiary Fortuneo was the entry point for the attack, saying that neither the division nor its customers’ accounts were involved.
Cyber experts told Reuters that while cyberattacks are common, it was unusual for money to be stolen virtually from a bank.
Rafay Baloch, CEO of cybersecurity and security engineering firm RedSecLabs, said the Credit Mutuel attack was unprecedented in Europe.
“We’re seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions,” he said.
France Opens Investigation
The Paris prosecutor’s office said its cybercrime unit received a complaint from Credit Mutuel Arkea on Wednesday and immediately opened an investigation, led by France’s cybercrime police.
Credit Mutuel Arkea’s spokesperson declined to identify the third-party service provider whose platform was used in the attack and said it had informed the European Central Bank, French banking supervisors and prosecutors. France’s banking regulator, the ACPR, declined to comment.
While successful hacks of large financial institutions are rare, financial regulators globally have stepped up warnings about the risk of cyberattacks, particularly with the growth of AI.
“Any time you have a hit in the financial system, it’s a big deal,” said Puneet Kakkar, Managing Director at Nardello & Co in Paris.
Brittany-based Credit Mutuel Arkea is a French co-operative banking group with more than 5.8 million customers and €211.5 billion in assets. It is part of the wider Credit Mutuel banking network and is affiliated with its central body, while retaining significant strategic autonomy.
French banks typically have strong cybersecurity, due to regulatory requirements, said Kakkar. Still, he said, “cybercriminals are becoming more opportunistic and more creative.”
In 2016, attackers stole $81 million from the Bangladesh central bank account at the Federal Reserve Bank of New York. Millions of dollars’ worth of funds have also previously been stolen from banks in Russia and India during cyberattacks, Reuters has reported.
However, insurers are facing another barrier that stems from the tech environments they already have.
“So many of the insurance companies that we’re talking about, particularly in the U.S., have spent incredible amounts of money either building their own systems or acquiring policy administration systems,” he said. “In some respects, they need to preserve their investment in their systems. They’ve spent a lot of money. They’re not just going to change those systems overnight.”
Newman described ACORD Solutions Group’s role as helping different systems communicate and converting data into trusted sources and formats that other participants can use. Instead of insisting that every organization migrate to a single new platform, the aim is to accommodate varying levels of digital maturity. He characterized this approach as building “a bridge between the old world and the new world.”
“It’s the difference of putting a brand new platform out there and saying everybody’s got to move to that new platform, which is a major, major change program,” he said. “We’re creating that bridge between the old world and the new world, which means anyone can get involved and digitalize their organization regardless of their level of digital maturity.”
This offers a way to establish a digital foundation now while preserving the option to change platforms later, he said.
“And then when you’re in a position to change your platform or change your system, if you choose to, you’ve already got that base layer there of digitalization,” he said. “So, it’s really looking to operationalize the standards, bring in that trust layer, but effectively remove a lot of inefficiency that’s in the industry at the moment, particularly for insurance companies.”
Rethinking the Operating Model
Larger change across the industry may come when carriers stop viewing AI as a way to automate individual tasks and start using trusted data to reconsider entire workflows, he added.
“The more forward-thinking carriers are starting to look at their end-to-end operating model. So they think, ‘Okay. We’ve got the base layer now, so I can now start to really look at how business could be done if it wasn’t constrained with some of these legacy processes.”
He said some insurers have already conducted tactical experiments involving smaller transactions. For Newman, the shift from “hype to actual real implementations” is only the beginning. The next opportunity, as he described it, is to decide which processes still make sense, which can be redesigned, and what trusted information needs to be in place to support that change.
“Some organizations are starting to step back and say, ‘Okay. We understand our business, but this is how some of the processes have been put together. How would we like them to really work? How does the business flow to us from our agents, from our distribution channel?’” he said. “They’re starting to re-engineer their operating models so they end up with this new digital operating framework. And I think that’s the real exciting opportunity that you can move to.”