Crédit Mutuel Arkéa, one of France's large mutual banking groups, has confirmed a cyberattack that enabled fraudulent transfers. The attackers reached the bank through one of its service providers' platforms. The money moved out of an Arkéa account, not customer accounts, and the bank says customer accounts are safe. Some transactions were suspended as a precaution, and the group's 5.8 million clients were warned to watch for phishing.

The blockchain investigator ZachXBT traced the loss and put it above 133 million dollars, about 118 million euros.

Asked about that figure, the bank said it could "validate the order of magnitude".

What that sentence actually says

An order of magnitude is a factor of ten.

A bank that validates the order of magnitude of 133 million dollars has agreed to a range running from roughly 13 million to 1.33 billion. That is the whole content of the statement.

Reuters separately reported the bank saying its losses were lower than the traced figure.

Both of those can be true simultaneously. A loss of 20 million is lower than 133 million and is the same order of magnitude. So is a loss of 130 million. The two statements together eliminate almost nothing, and the phrase that sounds like a confirmation is the one doing the least work.

This is not an accusation of dishonesty. A bank in the middle of a judicial investigation has real reasons to be imprecise, and "we are not commenting on the amount" would have been a cleaner way to be imprecise. What makes "order of magnitude" worth writing about is that it reads, to anyone skimming, as though the bank confirmed 133 million. Several outlets reported it that way.

The part that is confirmed

Strip out the amount and what remains is still a serious incident with a clear shape.

The entry was a supplier. The bank says the attackers came in through a service provider's platform and reached Arkéa directly. That is the same shape as a large share of this year's financial sector incidents, and it is the control that sits furthest from the bank's own security team.

The money came from the bank's own account. This distinction matters more than it sounds. Customer accounts being safe is good news for customers and tells you nothing about the size of the loss, because the loss is the bank's. It also means there is no population of affected individuals to notify, which removes most of the regulatory pressure that normally forces a number into the open.

The funds went to crypto exchanges, which is why a blockchain investigator has a figure at all and the bank's regulator does not have to publish one. The public number in this story exists because the money moved somewhere publicly observable. Had it moved through correspondent banking, there would be no figure to validate the order of magnitude of.

What is not established

  • The actual loss. That is the point of the article.
  • Which service provider. Sources conflict on whether Fortuneo, the group's online banking subsidiary, was involved; one report says the attack began there and another says it was explicitly ruled out.
  • How the attackers got into the provider, or from the provider into the bank.
  • Whether any funds have been frozen or recovered.
  • The bank's own communiqué, which we did not locate in full. Every statement here reaches us through reporting.
  • Whether ZachXBT's tracing is complete or a floor.