TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said attackers used a service provider’s platform to carry out fraudulent transfers from the bank’s own account. It told Reuters on 5 November that about €100 million was stolen; some funds have been blocked, but the final loss is unknown. The bank says customer accounts and deposits were not affected.
In statements issued on 4 November, the bank said it had been “the victim of an attack that enabled fraudulent operations.” It said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” The bank has not identified the service provider whose platform was used.
After detecting the attack, Arkéa said it informed the relevant authorities and supervisors and suspended some transactions as a precaution. Its banking app was unavailable for several hours, franceinfo reported. The bank said almost all operations resumed during the morning of 4 November and described the incident as closed and under control in a statement that afternoon.
On 5 November, Arkéa told Reuters that around €100 million had been stolen and that part of the money had been blocked. Earlier reports put the amount at $133 million, or about €118 million. The bank had declined to confirm that figure, saying it could validate only the “order of magnitude.”
Crédit Mutuel Arkéa reports a major theft What the timeline confirms
Attackers used a service provider’s platform to make fraudulent transfers from the bank’s own account. Customer accounts and deposits were not affected, the bank says.
What the bank confirms
The transfers came from Arkéa’s own account, not customer balances.
Deposits unaffected
The bank says customer accounts and deposits were not affected.
Platform involved
Arkéa says attackers used a service provider’s platform, but has not named the provider.
Final loss unknown
Some funds have been blocked; the bank has not given a final accounting.
Confirmed response timeline
The bank’s statements establish the response from 4 November.
What remains unclear
Investigators and the bank have yet to establish key details publicly.
- A service provider’s platform was involved.
- France’s anti-cybercrime office is leading the investigation.
- Arkéa says Fortuneo was not the entry point.
- The provider’s identity and access role.
- When the intrusion began.
- The final loss and how much can be recovered.
A Breach of the Bank’s Own Payments
The reported loss came from the bank’s own account, rather than customer accounts. That makes the case a reminder that a financial institution’s payment processes and the outside platforms connected to them can be targets, even when customers’ balances are not directly involved.
For businesses, the bank’s account of the attack puts supplier access to payment systems in focus. Arkéa says a service provider’s platform was involved, but has not explained what access the provider had or how fraudulent transfers were authorized. Those details will matter for understanding how the attack worked and what other institutions can learn from it.
For customers, the bank says deposits and accounts were unaffected. It also warned customers to watch for phishing attempts that exploit the news. The source material advises customers not to share passwords or SMS verification codes in response to unsolicited messages or calls.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Apple MacBook Pro 16-inch with M1 Pro, 10-core CPU, 16-core GPU, 16GB RAM, 1TB SSD, Silver
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What the Timeline Establishes
The bank’s statements provide the clearest confirmed timeline. On the morning of 4 November, after detecting the attack, it said it notified the relevant authorities and supervisors, suspended some transactions, and filed a complaint with the Paris prosecutor. The prosecutor’s office confirmed to AFP that an investigation had opened that morning. France’s anti-cybercrime office is leading the investigation, according to the source material.
Some earlier points remain press reports rather than bank-confirmed facts. Le Figaro reported that the attack began at a service provider in late October and that information about it circulated on X from 1 November. Crypto news outlets and Le Télégramme reported the $133 million figure before the bank gave Reuters its estimate. These accounts help explain how the story developed, but Arkéa has not confirmed those dates or the earlier amount.
Arkéa is a cooperative banking group based near Brest in Brittany. It includes the online bank Fortuneo. The bank has denied that Fortuneo was the entry point and said the attack came through a service provider. It has also ruled out human error on its side, according to its statements.
““the victim of an attack that enabled fraudulent operations””
— Crédit Mutuel Arkéa
The Provider and Final Loss
The bank has not named the service provider or described how attackers used its platform to initiate transfers. It has also not said when the intrusion began. The late-October start date and reports that information circulated online from 1 November come from Le Figaro and are not confirmed by the bank.
The final amount stolen remains unknown. Arkéa told Reuters that around €100 million was stolen and that some funds were blocked, but it has not provided a final accounting or said how much, if any, will be recovered. The investigation is ongoing, so details about the transfers and the attackers have not been established publicly.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section opened an investigation on the morning of 4 November into an alleged organised intrusion into a data processing system. France’s anti-cybercrime office is leading the case. Investigators will need to establish how the supplier platform was accessed, how the transfers were made, and where the money went.
Arkéa’s next public updates may clarify the provider’s role, the final loss and whether blocked funds can be returned. Until investigators and the bank release more information, the reported timeline before 4 November and the recovery prospects remain uncertain.
Key Questions
Was customer money taken?
Arkéa says the fraudulent transfers came from the bank’s own account and that customer accounts and deposits were not affected.
How much was stolen?
The bank told Reuters on 5 November that around €100 million was stolen. Some funds have been blocked, but the final amount and any recovery are not yet known.
How did the attackers get in?
The bank says the attackers came through the platform of a service provider. It has not named the provider or explained how the platform was used. Arkéa has denied that Fortuneo was the entry point.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened a case on 4 November. France’s anti-cybercrime office is leading the investigation.
Source: Thorsten Meyer AI
