French Bank Hit By Cyberattack, Hackers Steal $100 Million

French regional bank Crédit Mutuel Arkéa said on Wednesday it had been hit by a cyberattack that led to fraudulent transfers worth around 100 million euros ($112 million). The bank said the attack, which has since been “contained”, allowed hackers to access its own accounts and transfer funds to other banks. Customer accounts were not affected, and no losses were reported by clients. The Brittany-based co-operative banking group has more than 5.8 million customers and €211.5 billion in assets.

Arkéa said the stolen funds were then converted into cryptocurrencies on specialised platforms, but a portion had been blocked and efforts were being taken to recover the funds. The bank ruled out human error, saying it “was a sophisticated attack coming from the outside.” It temporarily suspended some transactions as a precaution, resulting in delays to some transfers, but said customer assets were not affected. It also rejected media reports that its online banking subsidiary Fortuneo was the entry point, saying neither the division nor its customers’ accounts were involved.

The Paris public prosecutor’s office said it had opened an official investigation after receiving a complaint from the bank on Wednesday. The investigation, led by France’s cybercrime police, concerns an “attack on an automated data processing system by an organised group.” Arkéa said it had informed the European Central Bank, French banking supervisors and prosecutors. The bank declined to identify the third-party service provider whose platform was allegedly used in the attack and did not disclose how the hackers breached its systems or who was behind it.

Arkéa said the amount concerned, which is still being evaluated, was not such as to undermine the financial health and solidity of the group. The lender earned a net profit of 230 million euros in the first half of the year. The fraud was first flagged by ZachXBT, an independent investigator who specialises in tracking funds on the blockchain, who said the stolen funds had been routed through multiple accounts opened on crypto exchange platforms. The attack follows the theft last week of $6.3 billion in cryptocurrency from Binance, in a rare case of cybercriminals successfully stealing from a mainstream bank.