Credit Mutuel Arkéa recovered some of the money stolen during the cyberattack revealed on Wednesday, November 4. Daniel Baal, President of the National Confederation of Credit Mutuel, announced Friday, November 6th on television. He did not specify the amount recovered or the proportion of funds recovered. The bank had recognised a diversion of over EUR 100 million. The definitive injury therefore remains to be established.
« Crédit Mutuel Arkéa has already recovered a part of it, » said Daniel Baal, according to a news agency. The word « today » refers to Friday, November 6, the day of his speech. This announcement marks a step forward in efforts to find the money. It does not constitute a financial balance sheet of the attack.
Credit Mutuel Arkéa does not yet quantify its losses
The manager confirmed that the amounts stolen exceeded EUR 100 million in order of magnitude. The more accurate figure of €118 million is circulating in the French press. However, Arkéa did not validate it as an exact amount. In its clarifications published on 4 November, the group accepted only the order of magnitude of this estimate.
Three elements still need to be distinguished: fraudulent transactions, locked-in funds and actual recoveries. As early as Wednesday, the bank reported that it had obtained the blocking of part of the money. It was pursuing further steps to recover it. The Friday statement does not allow us to know whether the funds mentioned by Daniel Baal correspond to the sums already blocked.
This distinction is relevant to the assessment of injury. An amount diverted does not necessarily become a permanent loss if funds can be returned. Conversely, the announcement of partial recovery does not provide information on the totality of the sums still sought. No recovery percentage can be deducted from publicly available information.
Arkéa states that the amounts involved do not threaten her financial health. The group did not accompany this assessment by a detailed account of the funds released, blocked and recovered. The publication of such a review will help to measure the effect of the ongoing approaches.
The bank’s own account was used for transfers
In its supplementary communiqué of 4 November, Arkéa described transfers made from its own account to other banking institutions. The group claims that the attackers did not use the accounts of the clients of its federations or subsidiaries.
The bank places the entry point on a provider’s platform. She doesn’t give her name. It denies an intrusion by Fortuneo, its online bank subsidiary, contrary to the first news in the press. It also spreads a human error within it and describes an attack from outside.
These details set out the version of the establishment. They do not constitute the findings of the investigation. The exact role of the provider and the mechanism for making transfers remain to be clarified. There is no public basis for assigning criminal responsibility to a named person or company.
Arkéa also evokes a possible conversion of money into cryptocurrency, after its transfer to other banking actors. The wording chosen remains conditional. It is not sufficient to establish that all the funds diverted have followed this route, nor to identify their final destination.
Delayed transfers, assets preserved according to Arkéa
The group suspended some transactions after detecting the attack. It presents this measure as a precautionary measure designed to prevent further fraudulent movements. For clients, the announced result was a delay in the execution of transfers.
In its communication of 4 November, the bank indicated that almost all operations had resumed in the morning. It stated that it had carried out checks and strengthened its security measures prior to the resumption. This situation does not constitute a real-time record of each service or operation.
Arkéa ensures that the incident did not result in any consequences on the assets of its clients. Daniel Baal took over this insurance on Friday, recalling that no private account had been affected according to the bank. The information available thus relates to fraud against the group’s funds, not to a general levy on customers’ savings.
The perimeter should be specified. Crédit Mutuel Arkéa includes the federations of Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest, as well as Fortuneo. The National Confederation of Crédit Mutuel, chaired by Daniel Baal, oversees the various federations. The two structures are not confused.
The investigation continues, with no announced award
The cybercrime section of the Paris Public Prosecutor’s Office opened an investigation after a complaint filed on Wednesday, according to judicial information reported by the French press. Investigations concern an infringement of an automated organized data processing system. They were entrusted to the Anti-Cybercrime Office.
Daniel Baal said on Friday he could not say whether the attack was French or foreign. No geographical origin can therefore be inferred from its declarations. Arkéa said to work with the judicial and police authorities to reconstruct the origin and conduct of operations.
The bank also maintains a preventive warning against phishing. It reminds its customers never to communicate their IDs, passwords, card numbers or validation codes received by SMS. In its clarifications, it explains this warning by the risk of scams exploiting the actuality of the attack. This warning alone does not constitute confirmation of a leak of customer data.
The expected future details relate to the amount actually recovered and the funds still sought. The partial recovery announced on 6 November leaves these two figures open.
Photo from Relecq-Kerhuon headquarters, 21 September 2023: FJaffres / Focale fixed, via Wikimedia Commons. IA-assisted coverage from actual photography. Photography and adaptation underCC BY-SA 4.0.Source photograph.
Comments