🔍 Read the full analysis: Crédit Mutuel Arkéa Says About €100M Was Stolen on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 4 that attackers used the bank’s own account to make fraudulent transactions through a service provider, rather than taking money from customer accounts. The bank told Reuters on Nov. 5 that about €100 million was stolen; some funds have been blocked, but the final loss and recovery amount remain unknown.
French cooperative bank Crédit Mutuel Arkéa says attackers used the bank’s own account to make fraudulent transactions, and it told Reuters on Nov. 5 that about €100 million was stolen. The bank says customer accounts were not used and customer deposits are unaffected; French authorities have opened a criminal investigation into the attack.
In a statement issued on Nov. 4, the bank said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It said the transactions did not go through accounts belonging to customers of its federations or subsidiaries. The bank also said the attack was detected and contained, and that it had suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to franceinfo, while the bank said almost all operations resumed during the morning.
The bank identified the route into its systems as the platform of one of its service providers. It has not named that provider. Arkéa said the attackers reached the bank directly through the supplier platform, denied that its online bank Fortuneo was the entry point, and said the incident was not caused by human error on its side. It said investigators are working to establish how the attack was carried out and where it originated.
The amount has been reported in stages. On Nov. 4, the bank declined to confirm reports of $133 million, or about €118 million, saying it would only validate the order of magnitude. On Nov. 5, it told Reuters that around €100 million had been stolen. The bank says some of the money has been blocked, but has not given a final accounting of the loss or the amount that may be recovered.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Exposure
The incident differs from familiar cases in which criminals steal card details or take money directly from individual accounts. According to Arkéa, the funds came from the bank’s own account, which means the immediate reported loss is an institutional one rather than a direct withdrawal from customers’ deposits. The bank says customer assets are unaffected, though the investigation and recovery effort are still underway.
The supplier route also puts attention on the access held by outside firms. A provider’s platform can become part of a bank’s payment security perimeter if it can connect to systems or initiate transactions. Arkéa has not described the provider’s role in detail, so the precise access that was abused is not yet known. For other organizations, the case is a reminder to review how third parties can reach financial systems and what checks apply to payments.
Customers may still face indirect risks. The bank specifically warned about phishing that could exploit public attention around the incident. That warning does not mean customer accounts were compromised; it means criminals may try to use the story to impersonate the bank or solicit credentials.
Popular right now
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
Dyson Ball Animal 3 Upright Vacuum – Corded, 290 AW, De‑tangling Motorbar Cleaner Head, 3 Suction Modes
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Disclosure Developed
Arkéa said it detected the suspicious activity on Nov. 4 and informed relevant supervisory bodies. It filed a complaint with the Paris prosecutor’s office, which confirmed that an investigation had opened that morning. The case was assigned to the prosecutor’s cybercrime section and is being led by France’s anti-cybercrime office. The stated offenses include an organized intrusion into a data processing system.
Reports about the suspected theft circulated before the bank’s detailed account. Le Figaro reported that the attack began at a service provider in late October and that information began circulating online from Nov. 1. Those details have not been confirmed by Arkéa. On the morning of Nov. 4, media reports cited a figure of more than €100 million, and some outlets reported the equivalent of about $133 million. The bank’s own public statement later that day confirmed the attack and supplier route, while its Reuters comments the following day supplied the approximate €100 million figure.
Arkéa is based near Brest and includes the Crédit Mutuel federations of Brittany and the South-West, along with subsidiaries including Fortuneo. The source material says the group reports more than 5.8 million members and customers and total assets of €211.5 billion. Those scale figures describe the organization, not the amount lost or the effect on customer deposits.
“The attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.””
— Crédit Mutuel Arkéa, statement issued Nov. 4
The Loss and Access Still Unclear
Several central details remain unresolved. Arkéa has not named the service provider, explained what systems or permissions its platform could access, or said precisely when the attackers first entered. Reports that the supplier itself was attacked in late October came from Le Figaro and have not been confirmed by the bank.
The final financial impact is also unsettled. The €100 million figure is an approximate amount the bank gave Reuters, not a final audited total. Arkéa has said part of the money was blocked, but has not disclosed how much, where it was blocked, or how much can be returned. Its earlier response did not confirm the reported €118 million figure.
The investigation must establish the attackers’ identity, their methods, and whether any data was accessed or taken. The bank says customer accounts were not used and customer deposits are not affected; available information does not establish that customer data was compromised. No findings on those questions have been reported in the supplied material.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the intrusion and the movement of funds. The bank says it is cooperating with judicial and police authorities. Further updates will be needed to clarify the service provider’s role, the attack timeline, and whether authorities or financial institutions can recover additional money.
Arkéa has said the incident is contained and that most banking operations resumed after precautionary suspensions. Customers should rely on official bank communications and treat unexpected messages about the incident with caution. The bank’s warning is practical: do not share passwords or one-time SMS codes in response to a call, text, or email claiming to be connected to the attack.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank says attackers used Crédit Mutuel Arkéa’s own account, not customer accounts, and says customer deposits are unaffected. The available information does not establish that customer data was accessed.
How much money was stolen?
On Nov. 5, the bank told Reuters that around €100 million was stolen. It has not provided a final total. The bank said some funds were blocked, but has not disclosed the amount recovered or potentially recoverable.
How did the attackers get in?
Arkéa says the attackers used the platform of one of its service providers to reach the bank. It has not named the provider or explained the technical route in detail, and investigators are examining the method.
Was Fortuneo involved as the entry point?
The bank says Fortuneo was not the entry point. It says the attackers reached Crédit Mutuel Arkéa through a service provider’s platform instead.
What should customers do now?
Be alert for messages that use the incident to impersonate the bank. Do not give anyone your password or SMS verification code in response to an unsolicited call, email, or text; contact the bank through its official channels if you are unsure.
Source: ThorstenMeyerAI.com
