🔍 Read the full analysis: Crédit Mutuel Arkéa Says About €100M Was Stolen on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account, using a service provider’s platform. The bank says customer accounts and deposits were not affected; French authorities have opened an investigation, and the final loss remains unknown.
Crédit Mutuel Arkéa said Nov. 5 that attackers stole about €100 million through fraudulent transactions made from the bank’s own account, after reaching it through a service provider’s platform. The French cooperative banking group says customer accounts were not used and customer deposits are not affected; prosecutors have opened a cybercrime investigation.
In a statement issued Nov. 4, the bank said the attackers used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions. It said those transfers may have enabled the funds to be converted into cryptocurrency through specialist platforms. The bank said the attackers did not use accounts belonging to customers of its federations or subsidiaries.
On Nov. 5, the bank told Reuters that around €100 million had been stolen. The figure is not a final accounting: Arkéa had earlier declined to confirm reports of €118 million, saying it would validate only the order of magnitude. The bank says some funds have been blocked, but the amount recovered or frozen has not been disclosed.
Arkéa said the attackers gained access through the platform of an unnamed service provider, which gave them a path to the bank. It denied that its online bank Fortuneo was the entry point and described the incident as an external attack rather than human error by its staff. The bank said it detected suspicious activity, notified relevant authorities and supervisors, and temporarily suspended some transactions as a precaution. Most operations resumed during the morning of Nov. 4, according to the source material.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from familiar banking fraud in which criminals take money directly from customer accounts. Arkéa says the transfers came from the institution’s own account, leaving the reported loss with the bank rather than its customers. That distinction matters to depositors, while the event still raises questions about the security of the systems banks use to move and manage their own funds.
The reported route through a supplier also highlights that a bank’s security depends partly on outside platforms with access to its operations. Arkéa has not named the provider or described the access involved, so the precise weakness is not known. For other financial firms, the case points to the need to examine supplier access and payment controls alongside defenses protecting customer-facing services.
Authorities and the bank are still tracing the funds. Arkéa says some money has been blocked, but it has not stated how much can be recovered. The final financial impact and any longer-term effect on operations therefore remain unsettled.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
Arkéa’s first public statement came on Nov. 4, after the bank said it detected the attack and notified competent and supervisory bodies. It described the incident as contained and said customer assets were unaffected. Its later question-and-answer statement gave further detail about the bank account used, the service provider route, and Fortuneo.
Reports of a loss had circulated before the bank confirmed the scale. Media outlets reported figures as high as €118 million, equivalent to $133 million in those reports. Arkéa did not confirm that amount. The bank’s statement to Reuters on Nov. 5 put the loss at around €100 million, while leaving the exact total open.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4, according to confirmation from the prosecutor’s office reported by AFP. The case concerns suspected organised intrusion into a data-processing system and is being handled with France’s anti-cybercrime office. The investigation is intended to establish how the intrusion occurred and how the transfers were carried out.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
The Entry Route and Recovery Remain Open
Several key details remain undisclosed. Arkéa has not identified the service provider, explained which platform functions were accessed, or said when the intrusion began. It also has not published a final accounting of the stolen funds or how much has been blocked. Those details may depend on the continuing criminal investigation.
The bank’s account of the route and the absence of customer-account involvement comes from its own statements. The available information does not provide an independent technical assessment of the attack. Reports that the incident began at a provider in late October or that warning information circulated online before Nov. 4 have not been confirmed by the bank in the supplied material.
It is also unclear whether all of the transfers can be reversed or whether the bank will recover the full amount. Arkéa says funds were sent to other banking players and may have been converted to cryptocurrency, but has not said where the money is now or how much is recoverable.
Investigators Trace the Transfers
The Paris prosecutor’s investigation, led with France’s anti-cybercrime office, is expected to examine how the provider platform was used, who initiated the transactions, and where the funds went. The bank says it is cooperating with judicial and police authorities. No public timetable for the investigation or further findings has been given.
Arkéa has also informed banking authorities, including the European Central Bank and French supervisors, according to its statements as reported by Reuters. Further updates from the bank could clarify the final loss, blocked funds and recovery prospects, as well as whether changes to supplier access or payment controls are planned.
For customers, the bank says their accounts and deposits were not affected. Arkéa has warned customers to be alert to phishing attempts that exploit the incident. Customers should treat unsolicited requests for passwords or SMS verification codes as suspicious; the source material says a bank will not ask customers to provide those credentials.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank says no. It says the attackers used Arkéa’s own account and did not transact through customer accounts. It also says customer deposits are not affected.
How much money was stolen?
Arkéa told Reuters on Nov. 5 that around €100 million was stolen. The bank has not provided a final figure, and it says some funds have been blocked.
How did the attackers reach the bank?
Arkéa says they used the platform of one of its service providers. The provider has not been named, and the bank has not publicly detailed the technical method.
Was Fortuneo involved as the entry point?
Arkéa said the attackers did not enter through Fortuneo, the group’s online bank. It said they reached the bank through a service provider’s platform instead.
Can the stolen money be recovered?
That is not yet clear. The bank says some funds have been blocked, but has not said how much or whether the full amount can be recovered. Authorities are investigating the transfers.
Source: ThorstenMeyerAI.com
