Crédit Mutuel Arkéa: Attack entered through service provider platform, losses still being assessed

Crédit Mutuel Arkéa disclosed that a recent cyberattack did not originate through its online bank Fortuneo but entered via a third-party service provider's platform, with attackers using the bank's own accounts to transfer funds to other banks and possibly converting them into cryptocurrency through specialist platforms. The bank did not confirm the reported €118 million ($133 million) loss figure but acknowledged it is in that range, saying some funds have been frozen and other recovery efforts are ongoing while the final financial impact is still being assessed. Customer assets were unaffected, the incident is contained, and most operations have resumed. The disclosure matters because it shifts scrutiny onto third-party vendor risk at banks and leaves open the question of how much of the stolen sum can ultimately be recovered.