🔍 Read the full analysis: Crédit Mutuel Arkéa Says About €100M Was Stolen on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said around €100 million was stolen through fraudulent transactions from the bank’s own account, using a service provider’s platform. The bank says customer accounts and deposits were not affected; some funds have been blocked, but the final loss and the provider’s identity remain unknown.
Crédit Mutuel Arkéa said on November 5 that around €100 million was stolen after attackers used a service provider’s platform to move money from the French bank’s own account. The bank says the transactions did not use customer accounts and that customer deposits are not affected; authorities have opened an investigation, while the final amount lost is still unknown.
The bank’s November 4 statement described the incident as an attack that enabled fraudulent operations. In a follow-up question-and-answer statement, it said attackers used Crédit Mutuel Arkéa’s own account to make transactions to other banking institutions. The bank said those transactions may have allowed money to be converted into cryptocurrency through specialist platforms. That possible conversion route is the bank’s account of what may have happened; the available statements do not establish how much, if any, was converted.
On November 5, the bank told Reuters the amount stolen was around €100 million. It had declined to confirm earlier reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. The bank says some of the funds have been blocked, but it has not given a final loss figure or said how much may be recovered.
Arkéa said the attackers gained access through a service provider’s platform, which gave them a route to the bank. It has not identified the provider. The bank said Fortuneo, its online banking subsidiary, was not the entry point, and described the incident as an external attack rather than human error by its own staff. Those statements do not yet explain the technical weakness or how the provider’s platform was used.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Route Was Targeted
The incident differs from fraud in which criminals take over individual customers’ accounts. According to Arkéa, the money came from the bank’s own account, and no customer account was used. That distinction matters to customers assessing whether their balances were directly involved, while the size of the reported loss makes the incident a major operational and financial event for the bank.
It also puts attention on the access held by third-party service providers. A supplier platform can become part of a bank’s security boundary when it can initiate or facilitate financial operations. The case may prompt other financial institutions and businesses to review supplier access, payment authorization and monitoring of unusual transfers. The specific control failures at Arkéa, if any, have not been disclosed, so the incident does not yet establish how the attack could have been prevented.
For customers, Arkéa says deposits are not affected. That does not remove the risk of follow-on scams: news of a large bank incident can be used in messages pretending to offer help or asking people to verify accounts. The bank has warned customers about phishing. Readers should treat unsolicited requests for passwords or one-time codes as suspicious and contact the bank through established channels.
Products Worth Considering
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
What Arkéa Has Disclosed So Far
Arkéa is a cooperative banking group based near Brest in Brittany. The source material describes a group that includes the Crédit Mutuel federations of Brittany and the South-West, as well as about 40 subsidiaries, including Fortuneo. It reports more than 5.8 million members and customers, 12,073 employees and total assets of €211.5 billion. Those figures indicate the scale of the institution, but they do not establish the effect of this incident on its financial position.
On the morning of November 4, the bank said it notified relevant authorities and supervisory bodies after detecting the attack, and suspended some transactions as a precaution. Franceinfo reported that the banking app was unavailable for several hours and that almost all operations resumed that morning. Arkéa later said the incident was contained and customer assets were unaffected.
The Paris prosecutor’s cybercrime section opened an investigation on November 4 into suspected organised intrusion into a data-processing system, according to reporting cited in the source material. France’s anti-cybercrime office is leading the inquiry. Reports about the attack’s possible start in late October, or information circulating online from November 1, have been attributed to media outlets and are not confirmed by the bank.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
The Loss and Attack Route Remain Unresolved
The reported €100 million is an approximate figure, not a final accounting. Arkéa has said some funds were blocked but has not disclosed the amount recovered, the amount still missing, or whether all transactions have been traced. It also has not provided a detailed timeline of when the attack began or how long the fraudulent activity continued.
The identity of the service provider remains undisclosed. The bank has not explained what access the platform had, which systems or credentials were involved, or what weakness attackers exploited. Its statement that the attack was sophisticated and external is the bank’s characterization; investigators have not publicly released a technical account or identified suspects in the material provided.
It is also not clear how much money, if any, reached cryptocurrency platforms, whether transfers can be reversed, or what findings authorities have made. Arkéa says customer accounts and deposits were not affected, but the scope of any data exposure has not been detailed in the statements summarized here.
Investigators and the Bank Face Key Questions
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating. Their work is expected to establish how the service provider’s platform was used, identify those responsible and trace the funds. No public timetable for findings is given in the source material.
Arkéa says it is working with judicial and police authorities to determine the attack’s origin and method. Further updates will need to clarify the final financial loss, how much money has been recovered or remains blocked, and whether the bank or its provider will disclose what security changes have been made. The bank has said the incident is contained and that most operations resumed after precautionary suspensions.
Customers should rely on official bank communications and be wary of messages that exploit the incident. Businesses can take the case as a reason to review which suppliers can initiate or support payments and how unusual transactions are checked. Those are general precautions; the investigation has not yet established which specific controls failed at Arkéa.
Key Questions
Was customer money stolen?
Arkéa says the attackers used the bank’s own account, not customer accounts, and that customer deposits are not affected.
How much money was stolen?
The bank told Reuters on November 5 that around €100 million was stolen. It says some funds have been blocked, and the final loss figure is not known.
How did the attackers get in?
Arkéa says they used a service provider’s platform to reach the bank. The provider and the technical details of the intrusion have not been disclosed.
Was Fortuneo the entry point?
No. Arkéa said the attackers did not enter through Fortuneo, its online banking subsidiary, and instead used a service provider’s platform.
What happens to the stolen funds now?
The bank says some of the money has been blocked, but it has not said how much can be recovered. Authorities are investigating the transfers and the route taken by the funds.
Source: ThorstenMeyerAI.com
