Start with onboarding
Attackers went through a service provider's platform to send money from Crédit Mutuel Arkéa's own account, the French bank said on November 4. Activity that arrives through a trusted provider can look routine. Alert triage gives each alert on that route a quick verdict with its evidence, so suspicious ones reach an analyst instead of waiting in a queue.
What happened at Crédit Mutuel Arkéa?
Crédit Mutuel Arkéa is a cooperative banking group based in Brest, France, with more than 5.8 million members and customers. On November 4 it said it had been "the victim of an attack that allowed fraudulent transactions to be carried out." The bank's word is attack. The press and the Paris prosecutor call it a cyberattack.
In its question-and-answer page, the bank says the attackers "went through the platform of one of our service providers" and so reached the bank directly. They used the bank's own account to send transfers to other banks, which then potentially let them convert the money into cryptocurrency. No customer account was used. The bank has not named the provider or said what its platform does.
Customers lost nothing, according to the bank. Some transfers were delayed while it suspended certain transactions, and almost all operations resumed the same morning. The bank told the European Central Bank, French banking supervisors and prosecutors, Reuters reported. The Paris prosecutor's cybercrime section opened an investigation on November 4. Nobody has claimed the attack.
How did the attack become public?
Through the blockchain. On November 2, the investigator ZachXBT posted that an unnamed "EU entity" had lost $106M+ from several crypto exchange accounts the day before. On November 3 he raised the total to $133M+ and wrote that the theft was "currently being covered up". Early on November 4 he named Crédit Mutuel Arkéa. The bank confirmed the attack by email that morning and published two statements that afternoon.
How much was taken, and for how long?
Nobody has published a final figure, and the numbers in circulation measure different things:
- $133M+ is ZachXBT's total of crypto exchange withdrawals, in US dollars, traced on the blockchain.
- €118 million comes from the French newspaper Le Télégramme, according to AFP. Asked about it, the bank said it does "not confirm this information" and "can only validate the order of magnitude".
- Around €100 million is the bank's provisional estimate, as reported by Reuters and AFP.
- More than €100 million is the order of magnitude Daniel Baal, president of Crédit Mutuel's national confederation, gave on November 6. He said part of the money had already been recovered.
The duration is disputed too. ZachXBT wrote that the attack "occurred for multiple days". The bank says its security systems identified the suspicious activity "very quickly" and contained it. Neither side has published a detection time.
What did early reports get wrong?
Three early claims do not match what the bank has said:
- A French journalist reported on November 4 that Fortuneo, the group's online bank, was the entry point. The bank says no entry was made through Fortuneo. Its spokesperson told Reuters that neither the division nor its customers' accounts were involved.
- Some headlines called it a crypto theft. The bank says the stolen funds were not cryptocurrency: the money left as ordinary currency and could have been converted afterward.
- At least one report attributed €118 million to ZachXBT. His posts give no euro figure; the euro amount comes from the press.
Why does activity through a provider look routine?
A service provider's platform is connected to a bank so that work can flow through it. Activity on that route is expected, so a fraudulent instruction on it can look like a normal one. A consultant told Le Monde that the alarms not going off showed a "very good knowledge of banking procedures". The bank has not said what its systems flagged, or when.
The provider route also does not move responsibility. Under DORA, the EU rule for financial entities' digital resilience, which has applied since January 17, 2025, a bank using ICT services must "remain fully responsible" for its obligations. Major ICT-related incidents must be reported. The initial notification is due within four hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. No source says whether Arkéa filed one.
For a security operations center (SOC), that puts the weight on the alerts that watch the provider route. An alert there needs a decision while the activity is still running, with the evidence beside it.
How does alert triage work, step by step in Imperum?
Alert triage is the first decision on an alert: close it, escalate it or hand it to a person. In Imperum, Virtus Triage, Imperum's autonomous alert triage, makes that decision on the alerts your rules route to it. Triage decides; it does not act on hosts or accounts.
This illustrative example follows alerts that a bank's own monitoring raises about a provider integration. It is not a reconstruction of the Arkéa attack, and the screens use synthetic data.
Step 1: Route the provider's alerts to Virtus Triage
Modus rules decide which alerts enter Triage and which create or join a case directly. Route the alerts from the systems that watch the provider integration; severity and source filters can narrow the selection.
Virtus Triage extracts the host, user and indicators, enriches the available evidence, applies policy gates and retrieves relevant knowledge. Where needed, an AI model assesses that context. The result is a verdict with a confidence score and its reasons: close, escalate or needs human.
Step 2: Escalate into a case with the evidence attached
An escalated alert can create a case in Casebook and start Virtus Pilot, subject to routing and run limits. The case brings linked alerts, indicators of compromise, affected entities and analyst notes into one investigation, and its timeline keeps who did what.
Virtus Pilot enriches the alert, builds an investigation plan and tests it with the configured connector tools. Its report brings together findings, recommendations and action status. In Guided mode, every planned action needs a person's approval, whatever its risk level.
Step 3: Review the uncertain verdicts and correct them
Results that need human review are queued for a person, and a failed close-safety check can turn a proposed closure into a review. Uncertain alerts wait in the Virtus Triage Queue in the Approval Center, where SOC operations teams review them.
An authorized analyst can choose a replacement verdict and enter a reason. The correction is recorded with a link to the original decision, and the override history is available for review. On a provider route, those reasons show where the rules need tightening.
What should you check this week?
- List the service providers whose platforms can act in your name, and the accounts and addresses they use.
- Check which alerts cover those routes, who reads them and how soon.
- If you are an EU financial entity, confirm who classifies an incident as major under DORA, and how fast.
- Expect phishing that uses the news. Arkéa warned its customers that phishing attempts are possible after the attack.
Questions about the Crédit Mutuel Arkéa attack
What is alert triage?
Alert triage is the first decision a security team makes on an alert: close it as noise, escalate it for investigation or hand it to a person to judge. Good SOC alert triage records why, with the evidence. In Imperum, Virtus Triage makes that first decision on routed alerts, and analysts can inspect the reasoning and correct the verdict.
Does alert fatigue explain the Crédit Mutuel Arkéa attack?
No source says so. The bank says its security systems spotted the suspicious activity very quickly, while ZachXBT says the attack ran for several days. Neither side has published a detection time or what the bank's systems flagged. Alert fatigue is a general risk: when alerts outnumber analysts, the ones that matter wait their turn.
Can false positive reduction close a real attack by mistake?
Closing noise is only safe inside limits. Virtus Triage closes an alert only when configured confidence thresholds, policy rules and safety checks allow it. A failed close-safety check can turn a proposed closure into a review, and uncertain results are queued for a person. Review a sample of closed alerts and the override rate before widening automation.
Can Imperum block a fraudulent bank transfer?
No. Imperum does not move or block bank payments. Virtus Triage works on the security alerts your systems send it and decides close, escalate or needs human. Containment belongs to Virtus Pilot and your approval rules, through the connector tools you configure. Payment controls stay in your own systems, with the evidence from the case beside them.
