TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said an attack enabled fraudulent transfers from the French bank’s own account, and told Reuters on November 5 that about €100 million had been stolen. The bank says customer accounts and deposits were not affected; some funds have been blocked, but the amount recovered is unknown.
Crédit Mutuel Arkéa said on November 4 that attackers used a service provider’s platform to make fraudulent transfers from the French bank’s own account. The bank told Reuters the next day that around €100 million had been stolen, while saying customer accounts and deposits were not affected.
The bank said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It said the entry point was “the platform of one of our service providers,” but has not named that provider. The bank also denied that its online bank, Fortuneo, was the entry point and ruled out human error on its side.
On the morning of November 4, the bank said it informed the relevant authorities and supervisory bodies after detecting the attack, and suspended some transactions as a precaution. Its banking app was unavailable for several hours, franceinfo reported. The bank said “almost all operations” resumed during the morning. In a statement at 1 p.m., it described the incident as “closed and under control” and said customer assets were unaffected.
The reported loss changed as more details emerged. On November 4, some outlets cited a figure of $133 million, or about €118 million. The bank initially declined to confirm that sum, saying it could “validate the order of magnitude.” On November 5, it told Reuters that around €100 million had been stolen. Some funds have been blocked, but the final amount recovered has not been disclosed.
Crédit Mutuel Arkéa €100 Million Hack
The bank says attackers used a service provider’s platform to transfer money from its own account. Customer accounts and deposits were unaffected.
How the transfers happened
Arkéa says the attackers used a supplier platform and the bank’s own account.
The bank identified a service provider’s platform as the entry point but has not named the provider.
Fraudulent transfers went from Arkéa’s own account to other banking players.
The Paris prosecutor’s cybercrime section opened a case on November 4; France’s anti-cybercrime office is leading it.
Disclosure timeline
The public estimate shifted as the bank and media reported more details.
What it means for customers
The bank says customer accounts and deposits were not involved in the transfers.
- Customer assets were unaffected.
- Some funds have been blocked.
- Almost all operations resumed during the morning of November 4.
- The final amount recovered is unknown.
- The supplier and technical access method have not been disclosed.
- The attack’s start date and perpetrators remain unconfirmed.
A Breach Through a Payment Provider
The incident shows how a supplier with access to payment systems can become part of a bank’s security exposure. Arkéa says the fraudulent transfers came through a service provider’s platform and used the bank’s own account. That account matters: the bank has said customer accounts were not used, distinguishing this incident from thefts involving individual customers’ cards or savings.
For other financial institutions and businesses, the reported route raises questions about how third-party access to payment systems is controlled and monitored. The bank has not described the specific weakness, the transactions involved or how the supplier’s platform was accessed, so the incident does not establish that other organizations face the same vulnerability. It does show why payment permissions and supplier access are relevant to investigations of financial cyberattacks.
For customers, the bank’s statements provide reassurance about deposits, but the story could also be used in impersonation attempts. Arkéa advised customers to watch for phishing. Anyone contacted about the incident should treat requests for passwords or SMS verification codes as suspicious; the source material says the bank will never ask customers for either.
Products Worth Considering
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
As an affiliate, we earn on qualifying purchases.
The November 4 Disclosure
The first public reports appeared before the bank confirmed the details. By the morning of November 4, crypto news outlets had reported a suspected loss of about $133 million and named Arkéa, Reuters said. Le Télégramme also reported $133 million, equivalent to roughly €118 million. Those early figures were reports, not the bank’s confirmed estimate.
At 10:29 a.m. on November 4, franceinfo reported that more than €100 million had been stolen, citing a source close to the case. At 1 p.m., Arkéa issued its first public statement, saying the incident was under control, customer assets were unaffected and customers should be alert to phishing. A second statement that evening answered questions about the bank account, service provider, Fortuneo and the amount.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4, according to the prosecutor’s office, which confirmed the case to AFP. The case concerns suspected organised intrusion into a data processing system, and France’s anti-cybercrime office is leading the investigation. Arkéa is a cooperative banking group based near Brest in Brittany. It includes the online bank Fortuneo and reported total assets of €211.5 billion.
Some accounts of the lead-up remain media reports. Le Figaro reported that a service provider was attacked in late October and that information began circulating on X from November 1. The bank has not confirmed those timings. Arkéa’s public account does not say when the attack began.
““used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players””
— Crédit Mutuel Arkéa
The Loss and Entry Point
The bank has not published a final accounting of the stolen funds or the amount recovered. It told Reuters that around €100 million had been stolen and said some money had been blocked, but the available statements do not give a confirmed recovery total. Earlier reports cited a higher euro equivalent, and the bank has not explained the difference.
Several details of the attack remain unknown. Arkéa has not named the service provider, explained how attackers gained access to its platform, disclosed when the intrusion began or described how many transfers were made. The reported late-October supplier attack and November 1 posts on X have been attributed to Le Figaro, not confirmed by the bank.
The investigation is ongoing. The bank says Fortuneo was not the entry point and denies human error on its side. Those statements do not, by themselves, explain the technical cause or establish who carried out the attack. No perpetrator has been identified in the material available so far.
Investigators Trace the Transfers
France’s anti-cybercrime office is leading the investigation opened by the Paris prosecutor’s cybercrime section. Investigators will be expected to establish how the supplier platform was accessed, which transfers were made and where the money went. The public statements reviewed so far do not set out a timetable for findings or say when a fuller account will be released.
Arkéa has said the incident is under control and that almost all operations resumed on the morning of November 4. The next concrete financial update would clarify how much of the reported loss has been blocked or recovered. Until the bank or investigators provide more detail, the precise loss, the attack’s start date and the supplier’s identity remain unresolved.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on November 5 that around €100 million had been stolen. It said some funds were blocked, but has not disclosed the final amount recovered.
Were customers’ accounts or deposits affected?
Arkéa said the transfers used the bank’s own account and that customer assets were unaffected. It said customer accounts were not used in the fraudulent operations.
How did attackers access the bank?
The bank said attackers came through the platform of a service provider. It has not named the provider or disclosed the technical method used to gain access.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened a case on November 4. France’s anti-cybercrime office is leading the investigation.
When did the attack begin?
The bank has not said when it began. Le Figaro reported a late-October attack on a service provider and posts circulating from November 1, but Arkéa has not confirmed those details.
Source: Thorsten Meyer AI
