🔍 Read the full analysis: Crédit Mutuel Arkéa Reports About €100 Million Theft on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 4 that attackers used the bank’s own account to make fraudulent transfers through a service provider. On Nov. 5, the bank told Reuters around €100 million had been stolen; it says customer accounts and deposits were not affected. The provider’s identity, the attack’s full mechanics and the amount ultimately recovered remain unknown.
Crédit Mutuel Arkéa said attackers used the bank’s own account to make fraudulent transfers through a platform operated by one of its service providers, and told Reuters on Nov. 5 that around €100 million had been stolen. The bank says customer accounts were not used and customer deposits are unaffected, while investigators work to establish how the attack happened.
In a statement issued on Nov. 4, the French cooperative banking group said it had been “the victim of an attack that enabled fraudulent operations.” The bank said the attackers used its account to send transactions to other banking players, and that the activity did not pass through accounts belonging to customers of its federations or subsidiaries. It has not said when the intrusion began or provided a full account of the transfers.
The amount has been reported with differing levels of certainty. On Nov. 5, Arkéa told Reuters that around €100 million was stolen. The bank had previously declined to confirm a reported figure of $133 million, or about €118 million, saying it would validate only the order of magnitude. Arkéa said part of the money had been blocked; the final loss and recovery total are not yet known.
The bank said the route into its systems was a platform belonging to an unnamed service provider. It denied that its online bank, Fortuneo, was the entry point and said the incident was not caused by human error on its side. Arkéa said it alerted relevant supervisory and judicial bodies, suspended some transactions as a precaution and worked with authorities. Its banking app was unavailable for several hours on Nov. 4, according to franceinfo, and the bank said almost all operations resumed that morning.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from fraud that takes money directly from an individual’s account: Arkéa says the transfers came from its own account. It highlights how a bank’s payment processes and connections to outside suppliers can become targets, even when customer accounts are not involved. The bank has not disclosed enough technical detail to establish which controls failed or how the attackers gained the ability to initiate transfers.
For customers, the bank’s statements provide reassurance about the reported scope: customer accounts and deposits were not affected, according to Arkéa. The incident may still prompt scam attempts that exploit public concern. Customers should treat unsolicited requests for passwords or one-time SMS codes as suspicious; the source material advises that a bank will not ask for those credentials.
For other organisations, the case is a reminder to account for suppliers with access to payment platforms in security reviews. That is a practical implication, not a finding by investigators about the precise cause. The provider is unnamed, and the complete sequence of events has not been made public.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
LG 55-Inch OLED evo G2 Series 4K Smart TV (OLED55G2PUA, 2022)
KitchenAid 5.5-Qt Bowl-Lift Stand Mixer, Porcelain White (KSM55SXXX)
As an affiliate, we earn on qualifying purchases.
What Arkéa Has Disclosed So Far
Arkéa is a cooperative banking group based near Brest in Brittany. The source material describes it as comprising the Crédit Mutuel federations of Brittany and the South-West and about 40 subsidiaries, including online bank Fortuneo. The group reports more than 5.8 million members and customers, 12,073 employees and assets of €211.5 billion. Those figures indicate the scale of the institution, but do not establish the impact of this attack beyond the bank’s stated account and amount.
On the morning of Nov. 4, the bank said it had notified competent and supervisory bodies after detecting the incident and had suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor. That afternoon, Arkéa said the incident was contained and customer assets were unaffected, then issued a question-and-answer statement describing the bank account and supplier platform. On Nov. 5, the bank gave Reuters its estimate of around €100 million stolen.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organised intrusion into a data-processing system, according to the source material. France’s anti-cybercrime office is leading the investigation. Reports about an earlier start date and online discussion before the bank’s announcement have been attributed to media accounts, not confirmed by Arkéa.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
The Provider and Recovery Remain Unknown
Arkéa has not named the service provider or described the technical weakness that allowed the fraudulent operations. The bank has not said when the attack began, how many transfers were involved, or which other institutions received them. Those questions are part of the ongoing investigation, and the public information available does not establish the attackers’ identities or full method.
The reported loss is also provisional. Arkéa told Reuters that around €100 million was stolen and said part of the funds had been blocked, but it has not disclosed how much was stopped or recovered. The earlier €118 million figure was not confirmed by the bank. It is not yet clear what the final net loss will be or whether additional details will change the estimate.
The bank said customer deposits were unaffected and that customer accounts were not used in the transfers. The source material does not report evidence contradicting that statement. Investigators have not publicly described their findings or said whether the incident affected other parts of the group’s systems.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the suspected organised intrusion. Their work is expected to address the route through the supplier platform, the people responsible and the movement of the funds. No timetable for findings or further public updates has been given.
Arkéa’s next important disclosures would be a firmer accounting of the amount stolen and funds blocked or recovered, along with any verified information about the supplier and the security changes made after the incident. Until those details are released, the bank’s estimate and description of the attack remain the clearest public account.
Customers should follow official communications from the bank and be cautious of messages claiming to offer help with the incident. Do not provide passwords or SMS verification codes in response to calls, texts or emails. For businesses, reviewing which suppliers can initiate or approve payments is a reasonable precaution, while the specific control gaps in this case remain under investigation.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts affected?
Arkéa says no. The bank said the attackers used its own account and did not use customer accounts; it also said customer deposits were unaffected.
How much money was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. The bank said part of the money had been blocked, but has not confirmed the final loss or recovery amount.
How did the attackers get in?
The bank said the attackers went through a platform operated by one of its service providers. It has not named the provider or released a detailed technical account.
Was Fortuneo the entry point?
Arkéa says it was not. The bank said attackers did not enter through Fortuneo and instead used a service provider’s platform.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened an investigation on Nov. 4 into suspected organised intrusion into a data-processing system. France’s anti-cybercrime office is leading the investigation, according to the source material.
Source: ThorstenMeyerAI.com
