A French bank lost around 118 million euros to hackers. For its customers, the risk is the phone call that comes next

Crédit Mutuel Arkéa announced on 4 November that it had been hit by a cyberattack. The crypto investigator ZachXBT had already put a figure on it: 118 million euros, roughly 133 million dollars. The bank won't confirm the exact amount, but its own FAQ says it can "validate the order of magnitude". According to BleepingComputer, the French cooperative group has more than 5.8 million members.

What makes this one unusual is where the money came from. The attackers didn't touch customer accounts. They came in through the platform of one of Arkéa's service providers and used the bank's own account to send money to other banks, where it was apparently converted into cryptocurrency. ZachXBT says it moved out as the stablecoins USDC and USDT. Arkéa says its online bank Fortuneo was not the way in, rules out human error and calls it a sophisticated attack from outside. Police are investigating, and part of the money has been blocked.

For customers, the bank's message is that their savings are unaffected. Some transfers were held back as a precaution, and Arkéa says nearly all of them resumed that morning. The bigger risk now is what usually follows a headline like this, and Arkéa says so itself: phishing attempts tend to surge after an attack. A caller claiming to be from the bank's fraud team, who needs to "secure" your account against the hackers, is a script that writes itself. No bank will ask you to read out a code from a text message or move your money to a "safe" account. If someone calls about this, hang up and ring your adviser on the number you already have.

Before the scam calls start, Tendvane's Privacy & accounts check is a good way to review how your email and other important logins are protected.