🔍 Read the full analysis: Crédit Mutuel Arkéa Hack: What Is Known So Far on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 4, 2026, that attackers used the bank’s own account to make fraudulent transfers through a service provider’s platform. On Nov. 5, the bank told Reuters that around €100 million was stolen; some funds have been blocked, but the final amount and recovery prospects remain unclear.
French cooperative banking group Crédit Mutuel Arkéa said around €100 million was stolen in fraudulent transactions made from the bank’s own account, not from customer accounts. The bank disclosed the attack on Nov. 4, 2026, saying attackers reached it through a service provider’s platform; on Nov. 5 it gave Reuters the approximate loss figure and said part of the money had been blocked.
The bank’s account of the incident centers on transfers made using Crédit Mutuel Arkéa’s own account. In a question-and-answer statement issued on Nov. 4, it said the attackers used that account to send transactions to other banking institutions. The bank said the transactions did not pass through accounts belonging to customers of its federations or subsidiaries, and that customer deposits were not affected.
Arkéa said the attackers gained access through the platform of one of its service providers. It has not identified the provider publicly. The bank said the online bank Fortuneo was not the entry point and described the incident as an external, sophisticated attack, while ruling out human error on its side. The exact method used to initiate or authorize the transfers has not been made public.
On Nov. 4, the bank said it had notified the relevant supervisory bodies after detecting the incident and had suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to franceinfo. The bank said almost all operations resumed during the morning and later described the incident as contained. On Nov. 5, it told Reuters that about €100 million had been stolen. It had earlier declined to confirm a reported €118 million figure, saying only that it could validate the order of magnitude. The definitive loss is not yet known.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why a Bank’s Own Account Was Targeted
The incident differs from fraud that drains individual accounts: the bank says the transfers came from its own funds, while customer accounts were not used. That distinction is central to what is confirmed so far, but it does not make the breach operationally minor. A large unauthorized movement of a bank’s money can trigger transaction suspensions, service disruption and investigations even if deposits remain untouched.
The reported route also draws attention to third-party access and payment controls. A supplier’s platform was the path described by the bank, but Arkéa has not named the supplier or detailed what permissions its systems had. For other organizations, the episode is a reminder that systems used by vendors to initiate or support payments can form part of an institution’s security exposure. The available information does not establish that the same weakness exists at other banks.
For customers, Arkéa’s statements say their accounts and deposits were not involved. The bank also warned about possible phishing linked to the news. People should treat unsolicited requests for passwords or SMS authentication codes as suspicious; the source material does not indicate that customer credentials were stolen in this incident.
Products Worth Considering
Apple MacBook Air 13.6-inch with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Apple MacBook Air 15-inch with M5 chip, 24GB RAM, 512GB SSD, Midnight
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID (Blush)
As an affiliate, we earn on qualifying purchases.
How the Disclosure Developed
The public timeline is incomplete because the bank has not said when the attack began. Some earlier dates come from media reporting, not from Arkéa. Le Figaro reportedly said the attack began at a service provider that was itself hit in late October and that information circulated on social media from Nov. 1. Those details have not been confirmed by the bank and should be treated as reported claims.
By the morning of Nov. 4, news organizations were reporting a suspected theft. The bank issued its first public statement that day, saying the incident was under control, customer assets were not affected and customers should be alert to phishing. A later question-and-answer statement described the bank’s own account and the service provider. The Paris prosecutor’s cybercrime section opened an investigation that morning, with France’s anti-cybercrime office leading it, according to the supplied reporting.
The amount also shifted from early reports to the bank’s later account. Media reports cited $133 million, or about €118 million, but Arkéa did not confirm that precise total. Reuters reported on Nov. 5 that the bank put the theft at around €100 million and said some funds had been blocked. These are separate points: the approximate amount is the bank’s reported estimate, while the higher figure remains an unconfirmed media report.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 question-and-answer statement
The Loss and Intrusion Details
The exact total stolen remains unsettled. The bank told Reuters that around €100 million was taken, but it has not provided a final accounting. It has said that part of the money was blocked; the amount blocked, the amount ultimately recovered and the timing of any recovery are not specified in the available material.
The public record also does not establish when the intrusion began, which service provider was involved, how attackers obtained access to its platform or how the transfers passed the relevant controls. Arkéa says it is working with investigators to determine the origin and method. Early reports about a late-October compromise and social-media circulation from Nov. 1 remain attributed media reporting rather than bank-confirmed facts.
Arkéa says customer accounts were not used and customer deposits were unaffected. No information in the supplied material confirms that customer data or credentials were taken. Those questions should not be treated as resolved beyond what the bank has stated; the investigation may produce further findings.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into an organized intrusion into a data-processing system. France’s anti-cybercrime office is leading the case. Investigators and the bank are seeking to establish how the supplier platform was used, the origin of the attack and the route taken by the funds.
Further updates are needed on the final loss, the portion of funds blocked or recovered, and whether investigators can identify those responsible. Arkéa has said it notified banking authorities and is cooperating with judicial and police services, but the available statements do not provide a timetable for results or for a final public accounting.
Customers should rely on official bank communications and be wary of messages that use the incident to request passwords, one-time codes or other sensitive information. Businesses may also review which suppliers can initiate or influence payments and how those actions are monitored. Those are precautionary steps, not evidence that customer accounts were compromised in this case.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on Nov. 5 that around €100 million was stolen. It has not confirmed a final total. A reported figure of €118 million was not confirmed by the bank.
Were customer accounts or deposits affected?
Arkéa said the attackers used the bank’s own account and did not go through customer accounts. The bank said customer deposits were not affected. The supplied information does not confirm that customer data or credentials were taken.
How did the attackers reach the bank?
The bank said the attackers came through the platform of one of its service providers. It has not named the provider or publicly explained the technical method used.
Has any of the money been recovered?
The bank said part of the money had been blocked. It has not disclosed how much was blocked, how much may be recovered or whether all funds can be traced.
What should customers do now?
Arkéa has warned customers about possible phishing related to the incident. Treat unsolicited requests for passwords or SMS verification codes as suspicious and consult the bank through its official channels.
Source: ThorstenMeyerAI.com
