🔍 Read the full analysis: Crédit Mutuel Arkéa Reports About €100 Million Stolen on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 4 that attackers used a service provider’s platform to access the bank and make fraudulent transfers from its own account. On Nov. 5, the bank told Reuters that around €100 million was stolen; it says customer accounts and deposits were not affected, and that some funds have been blocked. The investigation is ongoing, and the provider and final loss have not been disclosed.
In a statement issued on Nov. 4, the bank said the attackers used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions. It said the transfers did not pass through accounts held by customers of its federations or subsidiaries. The bank added that the money may have been converted into cryptocurrency through specialist platforms, but that description does not establish how much, if any, was converted or recovered.
The amount has been reported in stages. Arkéa initially declined to confirm reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. The bank told Reuters the next day that around €100 million was stolen. It has said part of the money has been blocked, but has not provided a final accounting of funds recovered or still missing.
Arkéa said the route into its systems was a platform operated by one of its service providers. It has not named the company. The bank said its online bank, Fortuneo, was not the entry point and described the incident as an external attack rather than human error by its own staff. It said suspicious activity was identified quickly and that some transactions were suspended as a precaution.
The bank said it notified relevant supervisory bodies and filed a complaint with the Paris prosecutor. Its mobile banking app was unavailable for several hours on Nov. 4, according to franceinfo. Arkéa said most operations resumed that morning and described the incident as contained. That account concerns the bank’s response and does not resolve the investigation into how the attackers gained access or moved the funds.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from fraud that drains individual current accounts: according to Arkéa, the funds came from a bank-owned account, not customers’ accounts. The bank says customer assets were unaffected, but the reported sum makes the case significant for financial institutions, regulators and companies that depend on external technology providers.
The reported route through a supplier highlights a potential weakness beyond a bank’s own systems. A provider’s platform may have access to operations that can initiate or facilitate payments. The precise access involved here has not been made public, so it is not yet possible to say which control failed or whether other institutions face the same exposure. For businesses, the case is a reminder to review supplier access to payment systems and to monitor transactions initiated through third parties.
For customers, the bank’s statements do not indicate that customer accounts were used or that deposits were affected. However, high-profile incidents can be exploited in phishing attempts. Arkéa advised customers to be alert to such messages. People should treat unsolicited requests for passwords or one-time codes with suspicion; the source material does not report that the bank asked customers to provide either.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
Samsung The Frame Pro LS03HW 65-inch Neo QLED TV with 27-Month Axiom Care
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How Arkéa Disclosed the Attack
Arkéa, headquartered near Brest in Brittany, brings together the Crédit Mutuel federations of Brittany and the South-West and operates subsidiaries including online bank Fortuneo. The group reports more than 5.8 million members and customers and total assets of €211.5 billion. Those figures describe the group’s scale; they do not establish the size of any impact on customers from this incident.
The bank’s first public statement on Nov. 4 said it had been “the victim of an attack that enabled fraudulent operations.” In a more detailed question-and-answer statement later that day, it explained that the attackers used a bank account and a supplier platform, and said Fortuneo was not the entry point. The bank has not disclosed when the attack began.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organised intrusion into a data processing system, according to reports of the prosecutor’s announcement. France’s anti-cybercrime office is leading the investigation. The investigation’s opening establishes that authorities are examining the case; it is not a finding about who was responsible or how the attack was carried out.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
Key Details Still Under Investigation
The bank has not identified the service provider, specified how its platform was compromised, or said when the attack began. Authorities have not publicly identified suspects or described a confirmed method. These questions remain under investigation, and the available statements do not establish whether the supplier itself was breached or how access to the bank’s account was obtained.
The final financial impact is also unsettled. Arkéa told Reuters that around €100 million was stolen and has said some funds were blocked, but it has not stated how much has been recovered, how much remains inaccessible, or whether the final amount will differ from the estimate. Earlier reports citing €118 million were not confirmed by the bank.
Arkéa says customer accounts and deposits were not affected and that the incident was contained. The extent of any interruption to services beyond the reported outage of the app, and the full scope of the fraudulent transactions, have not been detailed publicly. No evidence in the supplied reporting establishes that customer data was taken.
Police Probe and Recovery Efforts
The Paris prosecutor’s investigation, led by France’s anti-cybercrime office, is expected to establish how the attackers reached Arkéa’s systems, which transactions were involved and whether funds can be recovered. The bank says it is working with judicial and police authorities. No public timetable for the investigation has been announced.
Arkéa may provide further information as investigators trace the transfers and assess blocked funds. A fuller update would clarify the final loss, recovery amount, timing of the intrusion and the supplier’s role. Until then, the roughly €100 million figure remains the bank’s reported estimate, not a final audited total.
Customers should follow communications through the bank’s official channels and be wary of messages about the attack that request credentials or verification codes. Businesses can review which external providers can access payment workflows and how unusual transfers are detected. These are general precautions, not findings that a particular customer or supplier has been compromised.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on Nov. 5 that around €100 million was stolen. It has not issued a final figure. Earlier reports of about €118 million were not confirmed by the bank.
Were customer accounts or deposits affected?
Arkéa said the attackers used the bank’s own account and did not use accounts belonging to customers of its federations or subsidiaries. The bank said customer deposits were not affected.
How did the attackers get access?
The bank said the attackers came through the platform of one of its service providers. It has not named the provider or released technical details explaining how the platform was used.
Has the stolen money been recovered?
Arkéa said part of the money was blocked, but it has not disclosed how much was blocked or recovered. The amount still missing is not yet clear.
What happens next?
The Paris prosecutor’s cybercrime investigation is examining the case, with France’s anti-cybercrime office leading the work. Investigators are expected to establish the intrusion’s origin and method; no public timetable or final loss estimate has been announced.
Source: ThorstenMeyerAI.com
