🔍 Read the full analysis: Crédit Mutuel Arkéa Reports €100M Cyber Theft on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said about €100 million was stolen through transactions made from the bank’s own account after attackers accessed it through a service provider’s platform. The bank says customer accounts and deposits were not affected; part of the money has been blocked, while the final recoverable amount and the provider’s identity remain unknown.
French cooperative bank Crédit Mutuel Arkéa said around €100 million was stolen in a cyberattack that used the bank’s own account to send transactions to other financial institutions, rather than accessing customer accounts. The bank said the attackers entered through a service provider’s platform; it has reported the incident to authorities, and part of the money has been blocked.
On November 4, the bank said it had been “the victim of an attack that enabled fraudulent operations.” In a follow-up statement that day, it said attackers used Crédit Mutuel Arkéa’s own account to make transfers to other banking players. The bank said those transfers may have enabled the funds to be converted into cryptocurrency through specialist platforms. That description is the bank’s account of the method; the investigation has not publicly established the full sequence of events.
On November 5, the bank told Reuters that around €100 million had been stolen. Earlier reports cited €118 million, equivalent to $133 million, but the bank initially declined to confirm that figure, saying it would validate only the order of magnitude. It has said that some funds were blocked. The final amount lost or recovered has not been established in the material available so far.
The bank said suspicious activity was detected quickly, some transactions were suspended as a precaution, and the incident was contained. Its app was reportedly unavailable for several hours on November 4, while “almost all operations” resumed that morning. Arkéa said customer accounts were not used and customer deposits were unaffected. It also said Fortuneo, its online banking subsidiary, was not the entry point and rejected human error on its side; those statements remain the bank’s account pending the investigation.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The reported loss is significant not because customer accounts were drained, but because the attackers allegedly used a bank-controlled account to move a large sum. The incident focuses attention on payment permissions and connections that banks maintain with external suppliers. A supplier platform can become a route into systems or processes that handle financial transactions, even when customers’ own accounts are not the target.
For customers, Arkéa’s statements offer reassurance that their deposits and accounts were not affected, but they do not remove the risk of follow-on fraud. News of a high-profile bank incident can be used in phishing messages claiming to offer refunds, security checks or account protection. Customers should treat unexpected requests for passwords or one-time codes as suspicious; the source material advises that a bank will not ask for these credentials.
For financial institutions and other businesses, the episode is a reminder to include supplier access and payment initiation in security reviews. The bank has not disclosed the provider’s name or technical details, so the case does not yet show precisely which controls failed. Those answers matter for judging whether the incident reflects a weakness in one supplier relationship or a broader issue in third-party payment security.
Products Worth Considering
Samsung Galaxy Tab A7 Lite 8.7 32GB Wi‑Fi Android Tablet – Long‑Lasting Battery, Compact Slim Design, Sturdy Metal Frame (US Version)
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How the Incident Became Public
The timeline reported so far begins with online discussion before the bank’s public statement, but those early details are not all confirmed. Le Figaro reportedly said the attack began at a service provider that had itself been hit in late October, and that information circulated on X from November 1. These are media reports, not findings confirmed by Arkéa. Before the bank commented, some outlets reported a figure of $133 million, or about €118 million.
On the morning of November 4, Arkéa said it alerted competent and supervisory bodies after detecting the attack and suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor. The prosecutor’s cybercrime section opened an investigation that morning into suspected organised intrusion into a data-processing system, with France’s anti-cybercrime office leading the inquiry, according to the supplied reporting.
Arkéa issued a public statement at about 1 p.m. on November 4, saying the incident was under control and customer assets were unaffected. A later question-and-answer statement described the bank’s own account and the service-provider route. The bank’s November 5 estimate of around €100 million then gave a clearer public figure than the earlier reports, while leaving the recovery total unresolved.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
The Provider and Recovery Remain Unknown
The bank has not identified the service provider or explained how attackers used its platform to reach the bank’s account. It has also not disclosed when the intrusion began, how many transfers were made, which institutions received them, or whether the suspected cryptocurrency conversions were completed. These details are subject to the ongoing investigation.
The reported €100 million is an approximate theft figure, not a confirmed final loss. Arkéa says some money has been blocked, but has not said how much or whether the blocked funds can be returned. It is also not yet possible to independently verify the bank’s statements that customer accounts were not accessed and that Fortuneo was not the entry point. No evidence in the supplied material indicates customer deposits were affected.
The Paris prosecutor’s cybercrime investigation is intended to establish the origin of the attack and how it was carried out. Arkéa says it is cooperating with judicial and police authorities and has informed European and French banking supervisors. Further updates may clarify the supplier involved, the transfer path and the amount recovered.
Until those details are released, the bank’s statements and the reported investigation provide the clearest account available, but they do not settle the technical cause or full financial outcome. Customers should rely on direct communications from their bank and avoid links or messages requesting passwords, SMS codes or other credentials. Businesses should review which suppliers can access systems or initiate payments, while avoiding assumptions about the specific vulnerability in this case before investigators publish their findings.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts affected?
The bank says attackers used its own account, not customer accounts, and says customer deposits were unaffected. The investigation is ongoing.
How much money was stolen?
Arkéa told Reuters on November 5 that around €100 million was stolen. Some funds have been blocked, but the final loss and recovery amounts are not known.
How did the attackers reach the bank?
The bank says they accessed it through the platform of one of its service providers. Arkéa has not named the provider or disclosed the technical details.
Was Fortuneo the entry point?
Arkéa said the attackers did not enter through Fortuneo, its online banking subsidiary. That is the bank’s statement; authorities are still investigating the incident.
What should customers do now?
Be alert to messages exploiting the incident. Do not provide passwords or one-time SMS codes in response to unexpected calls, texts or emails, and contact the bank through its official channels if a message seems suspicious.
Source: ThorstenMeyerAI.com
