🔍 Read the full analysis: Crédit Mutuel Arkéa Hack: The €100 Million Timeline on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that around €100 million was stolen through fraudulent transactions from the bank’s own account, after attackers accessed it through a service provider’s platform. The bank says customer accounts were not used and deposits are unaffected; some money has been blocked, but the final loss and recovery prospects are not known.
Crédit Mutuel Arkéa said on Nov. 5 that attackers stole around €100 million through fraudulent transactions from an account belonging to the bank, not its customers. The French cooperative banking group says the attackers reached the account through a service provider’s platform; authorities have opened a criminal investigation, and the amount ultimately recovered remains unclear.
In a statement issued on Nov. 4, the bank said the attackers had used Crédit Mutuel Arkéa’s own account to make transfers to other banking institutions. The bank said those transactions may have enabled the funds to be converted into cryptocurrency through specialist platforms. It said the attackers did not use customer accounts belonging to its federations or subsidiaries, and that customer deposits were not affected.
The bank later told Reuters that around €100 million was stolen. Earlier reports cited a figure of $133 million, equivalent to about €118 million, but the bank had declined to confirm that amount, saying it would validate only the order of magnitude. The bank has said part of the money has been blocked; it has not given a final loss figure or detailed how much may be returned.
Arkéa said the route into its systems was a platform operated by one of its service providers. It has not named the provider. The bank said Fortuneo, its online banking subsidiary, was not the entry point and described the incident as an external attack. On Nov. 4, it said it had alerted relevant authorities and supervisors, suspended some transactions as a precaution and filed a complaint. Some transactions were restored that morning, while the banking app was reportedly unavailable for several hours.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from fraud that directly drains individual customers’ accounts: according to the bank, the funds came from the institution’s own account. That makes the case relevant to banks and other businesses that use third-party platforms to initiate or support payment activity. A supplier’s access can form part of an organization’s financial risk, even when customer accounts are not the immediate target.
For customers, Arkéa’s statement that deposits were unaffected is a key distinction. The disclosure does not, by itself, establish that customer information or accounts were compromised. It may, however, prompt scam attempts that exploit public concern. The bank has advised customers to be alert to phishing; people should not share passwords or one-time SMS codes in response to unsolicited messages or calls.
The sums involved also leave a significant financial question open. The bank has confirmed an approximate amount stolen and says some funds were blocked, but it has not published a final accounting. Until the investigation traces the transactions and any recovery, the ultimate cost to the bank is not established.
Products Worth Considering
Apple MacBook Air 15-inch with M5 chip, 16GB memory, 512GB SSD, and Liquid Retina display (Midnight)
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
As an affiliate, we earn on qualifying purchases.
How the Timeline Developed
The bank’s first public statements came on Nov. 4, 2026. It said the incident had been detected, relevant bodies informed and some transactions suspended. A statement later that day described the attack as contained and said customer assets were not affected. A question-and-answer statement issued that afternoon provided more detail on the bank account, the service provider and Fortuneo.
French media reported that information about the incident had circulated before the bank’s public announcement. Le Figaro reported that the attack began at a service provider hit in late October and that information started circulating on X from Nov. 1. Those details are media reports, not facts confirmed by the bank. Early reports also quoted a larger figure of about €118 million; Arkéa did not confirm it.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organized intrusion into a data processing system. France’s anti-cybercrime office is leading the inquiry, according to the supplied reporting. The bank says it is cooperating with judicial and police authorities to determine how the attack was carried out.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued Nov. 4
The Final Loss Is Still Unknown
The bank has not stated when the attack began, how long the attackers had access, or which service provider’s platform was involved. It has also not detailed the technical method, the number or timing of the transfers, or how the provider’s access was obtained. Those points remain subject to the investigation.
Arkéa’s estimate is around €100 million, not a final audited loss. The bank says some funds have been blocked, but has not specified the amount, whether those funds can be returned, or what portion of the total remains unrecovered. Early media reports and the bank’s later estimate differ; the precise accounting is not yet public.
The bank says customer accounts were not used and deposits are unaffected. The available statements do not settle whether other data or services were affected beyond the reported temporary app disruption. No evidence provided in the source material confirms a customer data breach.
Investigation and Recovery Continue
The Paris prosecutor’s investigation is expected to establish how the attackers accessed the bank through the supplier platform, how the fraudulent transfers were routed and whether funds can be recovered. Arkéa says it is working with authorities and is seeking to determine the attack’s origin and method. The bank has not announced a timetable for a final loss estimate or public findings.
For now, the bank’s position is that the incident is contained, customer deposits are unaffected and some transactions have resumed. Readers should rely on updates from the bank and authorities for any change to that status. Customers should treat unexpected messages claiming to be about the incident with caution and never provide account passwords or SMS verification codes.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on Nov. 5, 2026, that around €100 million was stolen. It has not published a final loss figure. Earlier reporting cited about €118 million, which the bank did not confirm.
Were customer accounts or deposits affected?
Crédit Mutuel Arkéa says the transactions came from the bank’s own account, not customer accounts, and that customer deposits were not affected. The supplied information does not confirm a customer data breach.
How did the attackers access the bank?
The bank says the attackers came through the platform of one of its service providers. It has not named the provider or disclosed the technical method. Arkéa also said Fortuneo was not the entry point.
Can the stolen money be recovered?
The bank says part of the money has been blocked, but has not said how much or whether it will be returned. The final recoverable amount is unknown while the investigation continues.
What should customers do now?
Be alert for phishing messages that use the incident as a pretext. Do not provide passwords or one-time SMS codes to callers or through links in unsolicited messages; check account notices through the bank’s official channels.
Source: ThorstenMeyerAI.com
