Massive Cyberattack Hits French Banking Sector: Nearly €100 Million Stolen — Is Customers' Money Really Safe?

A major cyberattack has recently targeted a large French banking group, resulting in the theft of tens of millions of euros. Hackers reportedly exploited a security vulnerability involving an external technology provider to gain access to funds belonging to the financial institution. Although customer accounts were reportedly unaffected, the incident raises serious concerns about banking cybersecurity and the protection of personal savings.

A Cyberattack With Devastating Financial Consequences

The French banking sector is facing another major cybercrime incident of exceptional scale.

According to initial reports, the stolen funds could amount to nearly €100 million. Some estimates have even suggested losses exceeding €118 million, although the final financial impact has yet to be confirmed.

Cybercriminals allegedly exploited the computer systems of a third-party service provider to gain unauthorized access to an account directly owned by the financial institution.

Several fraudulent transfers were reportedly made to other banks. Some of the stolen funds may have been converted into cryptocurrencies, potentially making recovery more difficult.

Emergency measures were quickly implemented to block suspicious transactions, and efforts are underway to recover at least part of the stolen money.

A judicial investigation will now seek to establish how the attackers gained access, identify potential security failures, and determine the techniques used to carry out the operation.

Are Customers' Bank Accounts at Risk?

Following an attack of this magnitude, one question immediately comes to mind: is the money held in bank accounts truly secure?

According to statements from the affected institution, the stolen funds belonged to the bank itself rather than its customers.

As a result, no direct financial losses involving individual customer accounts have been reported in connection with this incident.

However, certain banking operations were temporarily suspended while additional security controls were introduced.

These precautionary measures caused delays in processing some bank transfers.

The institution has stated that the cyberattack does not threaten its financial stability and that services are gradually returning to normal.

Hackers Are Increasingly Targeting Third-Party Providers

This incident highlights a particularly concerning trend in modern cybercrime.

Instead of attacking a major bank's infrastructure directly, cybercriminals may target one of its technology suppliers or external service providers.

This technique, commonly known as a supply chain attack, can allow hackers to bypass sophisticated security defenses by compromising a less protected partner.

Financial institutions now rely on numerous external platforms to process payments, exchange information, and manage technical operations.

Every additional connection can potentially create another entry point for attackers.

Since January 2025, the European Union's Digital Operational Resilience Act (DORA) has imposed stricter cybersecurity and operational resilience requirements on financial institutions.

These regulations include enhanced oversight of technology providers, regular security testing, and mandatory procedures for reporting major incidents.

Nevertheless, even the most advanced cybersecurity infrastructure cannot guarantee absolute protection.

Who Pays When a Bank Account Is Compromised?

European regulations provide several protections for consumers who become victims of unauthorized banking transactions.

When an unauthorized payment is identified, banks are generally required to refund the affected customer promptly, no later than the end of the following business day after notification or detection.

Account holders typically have up to 13 months after the transaction date to dispute an unauthorized payment.

However, exceptions may apply, particularly when customer fraud or gross negligence has been established.

It is also important to distinguish reimbursement for unauthorized transactions from deposit protection schemes.

In France, eligible bank deposits are generally protected up to €100,000 per depositor, per institution, in the event of a bank failure.

This protection does not automatically compensate customers for losses directly resulting from a cyberattack.

Beware of Fake Banking Emails and Text Messages

Major cyberattacks can also trigger a wave of secondary scams targeting unsuspecting customers.

Fraudsters sometimes take advantage of widely reported security incidents to send fake emails or text messages impersonating legitimate financial institutions.

These messages may claim that an account has been suspended, a suspicious transfer has been detected, or urgent identity verification is required.

Their objective is often to steal login credentials, passwords, or one-time authentication codes.

Such attacks, commonly known as phishing, can be particularly convincing when they reference real events covered by the media.

Customers should never disclose confidential banking information and should always verify unusual requests through their bank's official website or customer support channels.

Regularly reviewing account activity also helps identify suspicious transactions before further damage occurs.

Banking Cybersecurity Remains a Major Challenge

This cyberattack demonstrates that even financial institutions investing heavily in cybersecurity remain vulnerable to increasingly sophisticated threats.

The growing interconnectedness of banking systems, dependence on external technology providers, and speed of digital financial transactions are creating new security challenges.

For banks, cybersecurity can no longer focus exclusively on protecting internal servers and infrastructure.

It must also extend across the entire ecosystem of technology suppliers, payment processors, and third-party partners.

For consumers, existing banking protections remain important safeguards, but personal vigilance is still essential.

The potential theft of nearly €100 million serves as a powerful reminder that a single security weakness within an external technology provider can trigger a major financial crisis.

As financial transactions become almost entirely digital, the real question is no longer simply whether banks can be hacked, but whether they are adequately prepared to withstand the next major cyberattack.