🔍 Read the full analysis: Crédit Mutuel Arkéa Says About €100M Was Stolen on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through fraudulent transfers from the bank’s own account, not customer accounts. The bank says attackers accessed it through a service provider’s platform; French authorities are investigating, while the exact loss and recovery prospects remain unclear.
Crédit Mutuel Arkéa said on November 5 that attackers stole about €100 million through fraudulent transactions from the bank’s own account, after gaining access through a service provider’s platform. The bank says customer accounts and deposits were not affected; French authorities have opened a cybercrime investigation, and the final loss and amount recoverable are not yet known.
In a question-and-answer statement issued on November 4, the bank said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It said those transactions may have enabled the money to be converted into cryptocurrency through specialised platforms. The bank said the attackers did not use accounts held by customers of its federations or subsidiaries.
The bank identified the route into its systems as the platform of a service provider, but has not named the provider or explained how the platform was compromised. It said Fortuneo, its online banking subsidiary, was not the entry point. The bank described the incident as a sophisticated external attack, denied human error on its side and said its security systems identified suspicious activity quickly.
On November 4, Arkéa said it notified relevant supervisory bodies after detecting the attack and suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to franceinfo. The bank said almost all operations resumed that morning and described the incident as contained. It filed a complaint with the Paris prosecutor’s office, which opened an investigation that day.
The amount was not settled in the bank’s first public statements. Arkéa initially declined to confirm reports of €118 million, saying it could validate only the order of magnitude. On November 5, it told Reuters that around €100 million had been stolen. The bank said part of the funds had been blocked, but has not provided a final figure for the loss or the amount recovered.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Routes Exposed
The reported loss highlights a different risk from familiar scams involving stolen card details or customers being tricked into transferring their savings. In this case, the bank says the attackers used the institution’s own account, with access obtained through a supplier’s platform. That makes the security of third-party systems and the payment permissions they hold central to the investigation.
For customers, Arkéa says their accounts and deposits were not involved. The incident nevertheless carries a practical risk: news of a major bank attack can be used in phishing attempts that impersonate the bank or claim to offer help. Customers should treat requests for passwords or one-time SMS codes as suspicious; the source material warns that a bank will not ask customers to provide those credentials.
The case also matters to businesses that rely on external providers to initiate or process payments. The bank has not said which provider was involved or detailed the access it had. Until those facts are established, the incident shows why supplier access and payment controls are relevant parts of an organisation’s security exposure, without establishing that any particular weakness caused this attack.
Products Worth Considering
Logitech MX Master 3S Bluetooth Wireless Mouse, Graphite
Logitech MX Keypad Programmable Macro Pad for Developers, Graphite
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Early Reports to Bank Estimate
The bank’s public account began on November 4, 2026. Its first statement said it had been the victim of an attack that enabled fraudulent operations, that customer assets were not affected and that the incident was under control. A more detailed statement later that day described the bank’s own account and the service-provider route. The Paris prosecutor’s office confirmed that an investigation had opened that morning.
Reports of a possible loss circulated before Arkéa confirmed an estimate. Some media reports cited $133 million, or about €118 million; the bank initially did not confirm that number. Its statement on November 5 to Reuters put the theft at around €100 million. Those figures have different levels of confirmation: the later estimate is attributed to the bank, while the larger amount was reported but not confirmed by it.
Crédit Mutuel Arkéa is based near Brest in Brittany and groups the Crédit Mutuel federations of Brittany and the South-West, along with about 40 subsidiaries, including Fortuneo. The group reports more than 5.8 million members and customers and total assets of €211.5 billion. Those figures describe the scale of the institution; they do not establish the attack’s impact on customers or the bank’s eventual financial loss.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued November 4
Losses, Access and Recovery Unresolved
The bank has not given a final accounting of the stolen funds. It said part of the money was blocked, but has not specified how much, whether the remaining transfers can be traced or how much could ultimately be returned. The November 5 estimate of around €100 million should therefore be treated as the bank’s current reported figure, not a final recovery or loss total.
Key technical and investigative details are also unavailable. Arkéa has not named the service provider, disclosed when the intrusion began or described the specific weakness that allowed access. The bank said it was working with judicial and police authorities to establish the attack’s origin and method. The Paris prosecutor’s cybercrime section opened a case for organised intrusion into a data-processing system, led by France’s anti-cybercrime office.
Claims reported before the bank’s statements, including a possible start date in late October, have not been confirmed by Arkéa in the source material. It is also not clear whether any cryptocurrency conversion was completed: the bank said the transfers potentially allowed conversion through specialised platforms, not that it had confirmed the full path of the funds.
Investigation and Fund Tracing Continue
French investigators are working to determine how the provider’s platform was used, who carried out the transactions and where the money went. Arkéa says it is cooperating with judicial and police authorities. Further public information may clarify the provider’s role, the start and duration of the intrusion, and whether blocked funds can be returned.
The bank may also provide a clearer accounting as the transaction review and investigation progress. For now, it says the incident is contained and customer accounts were not involved, while the amount stolen remains an estimate and the recovery total is unknown. Customers should rely on direct communications from the bank and avoid responding to messages asking for passwords or SMS verification codes.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts used?
The bank says attackers used Crédit Mutuel Arkéa’s own account, not customer accounts held by its federations or subsidiaries. It says customer deposits were not affected.
How much money was stolen?
On November 5, the bank told Reuters that around €100 million had been stolen. It has not issued a final loss figure, and some funds have reportedly been blocked.
How did the attackers get access?
Arkéa says the attackers came through a service provider’s platform. It has not named the provider or publicly described the specific vulnerability or access method.
Was Fortuneo involved as the entry point?
The bank said Fortuneo was not the entry point. It attributed the route into the bank to a service provider’s platform.
Can the stolen money be recovered?
The bank says part of the money was blocked, but has not said how much or how much can be recovered. The final recovery amount remains unclear.
Source: ThorstenMeyerAI.com
