🔍 Read the full analysis: Arkéa Says About €100 Million Was Stolen on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 4, 2026, that attackers used the bank’s own account to make fraudulent transfers through a service provider. The bank told Reuters the next day that around €100 million was stolen; it says customer accounts and deposits were not affected. Some money has been blocked, but the final loss and recovery prospects remain unknown.
Crédit Mutuel Arkéa said on Nov. 4 that attackers used the French bank’s own account to make fraudulent transfers through a service provider, and told Reuters on Nov. 5 that around €100 million was stolen. The bank says customer accounts were not used and customer deposits are unaffected; some of the money has been blocked, but the final loss is not yet known.
In a question-and-answer statement issued on the evening of Nov. 4, the bank said the attackers used an account belonging to Crédit Mutuel Arkéa to make transactions to other financial institutions. The bank said those transfers may have allowed the money to be converted into cryptocurrency through specialist platforms. It stressed that the attackers did not route the transactions through accounts belonging to customers of its federations or subsidiaries.
The bank said the route into its systems was a platform operated by one of its service providers. It has not named the provider. Arkéa said its online bank, Fortuneo, was not the entry point and described the incident as an external attack rather than human error on its side. It said security systems detected suspicious activity quickly and that the incident was contained.
On the morning of Nov. 4, the bank said it notified relevant authorities and supervisory bodies and suspended some transactions as a precaution. Franceinfo reported that its banking app was unavailable for several hours and that almost all operations resumed during the morning. Arkéa filed a complaint with the Paris prosecutor. On Nov. 5, the bank told Reuters the stolen amount was around €100 million. It said a portion had been blocked, without giving a final recovered or unrecovered total.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank Account Became the Target
The case differs from fraud in which attackers take money directly from individual customers. Here, the bank says the transfers came from its own account, while customer accounts were not used. That distinction matters to customers concerned about the safety of their deposits, although it does not remove the risk of operational disruption or follow-on scams.
The incident also puts attention on third-party access and payment controls. A supplier platform can form part of a financial institution’s path to sensitive operations, even when the supplier itself is not a bank. The investigation may clarify how the attackers reached the payment process, what controls were bypassed, and how quickly transfers can be stopped or recovered. Those details have not yet been made public.
The bank’s account of the event should not be read as a complete technical explanation. It has provided a high-level description, but has not identified the supplier, explained the specific weakness, or detailed the sequence of authorisations behind the transfers. For other organisations, the confirmed supplier route is a reason to examine access and payment procedures, not evidence that the same method was used elsewhere.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
The bank has not said when the attack began. A Le Figaro report, cited in the source material, said the incident started at a service provider that was itself attacked near the end of October. That account is reported rather than confirmed by Arkéa. The same newspaper said information about the incident circulated on social media from Nov. 1.
By the morning of Nov. 4, reports citing a figure of about $133 million, or €118 million, were circulating. Arkéa initially declined to confirm that amount, saying it would validate only the order of magnitude. At 10:29 a.m. on Nov. 4, Franceinfo reported a theft of more than €100 million, citing a source close to the case. The bank issued its first public statement at 1 p.m., saying the incident was contained and customer assets were not affected. Its more detailed Q&A followed at about 5:30 p.m.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organised intrusion into a data-processing system. The case is being handled by France’s anti-cybercrime office. On Nov. 5, Arkéa told Reuters the amount stolen was around €100 million and said it had informed European and French banking authorities as well as prosecutors.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued Nov. 4
The Supplier and Recovery Remain Unknown
Arkéa has not disclosed the service provider’s identity, the precise vulnerability or access path, or when the attackers first entered the relevant systems. The bank’s statement that the incident was contained does not establish whether every compromised access route has been identified or how the transfers were authorised.
The final amount lost is unsettled. Arkéa told Reuters that about €100 million was stolen and said part of the money had been blocked, but it has not specified how much was frozen, returned or remains at risk. The earlier €118 million figure was reported by media outlets and was not confirmed by the bank. It is also unclear whether any funds converted into cryptocurrency can be traced or recovered.
The investigation is ongoing. The bank’s assertions that Fortuneo was not the entry point, that customer accounts were not used and that customer deposits were unaffected are statements from Arkéa; the public record provided so far does not include an independent forensic report.
Investigators Trace the Transfers
French investigators are examining the suspected intrusion and the movement of funds. The Paris prosecutor’s cybercrime section opened the case on Nov. 4, with the national anti-cybercrime office leading the work. The bank says it is cooperating with judicial and police authorities and relevant banking supervisors.
Further updates may establish how the supplier platform was involved, the total value of the fraudulent transactions, and how much money can be recovered. Arkéa has not announced a timetable for a public technical report or provided a date for its next update.
Customers should follow notices from the bank and treat unexpected messages about the incident cautiously. Arkéa warned customers about phishing. Do not share passwords or one-time SMS codes in response to calls or messages claiming to help recover funds; verify any contact through the bank’s official channels.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts used?
The bank says no customer accounts were used. It says the transfers came from an account belonging to Crédit Mutuel Arkéa and that customer deposits are unaffected.
How much money was stolen?
Arkéa told Reuters on Nov. 5 that around €100 million was stolen. The bank has not given a final loss figure, and some money has reportedly been blocked.
How did the attackers get in?
The bank says the attackers came through the platform of one of its service providers. It has not named the provider or published a detailed account of the technical route.
Was Fortuneo involved as the entry point?
Arkéa said the attackers did not enter through Fortuneo, its online bank. That is the bank’s account; the investigation is continuing.
Can the money be recovered?
Arkéa said a portion of the funds had been blocked, but it has not said how much or confirmed the amount recovered. The recovery outlook remains unclear while authorities trace the transfers.
Source: ThorstenMeyerAI.com
