🔍 Read the full analysis: Arkéa Says About €100 Million Was Stolen on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that around €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers accessed it through a service provider, not customer accounts or its Fortuneo online bank. Some funds have been blocked, but the final loss and recovery amount remain unknown.
French cooperative bank Crédit Mutuel Arkéa said on Nov. 5 that attackers stole around €100 million from the bank’s own account, using a service provider’s platform to carry out transactions to other financial institutions. The bank says customer accounts were not used and customer deposits are not affected; investigators are working to establish how the attack was carried out and where the money went.
In a statement issued on Nov. 4, Arkéa said the attackers used the bank’s own account to make transactions to other banking players. The bank said those transactions may have allowed the funds to be converted into cryptocurrency through specialized platforms. It has not confirmed that all of the money was converted or identified any recipient institutions.
The bank told Reuters on Nov. 5 that around €100 million had been stolen. It had earlier declined to confirm reports of $133 million, or about €118 million, saying it could only validate the order of magnitude. Arkéa says some of the funds have been blocked, but the final amount lost and the amount that may be recovered are not yet known.
Arkéa said the attack came through the platform of one of its service providers, which it has not named. It said Fortuneo, its online banking subsidiary, was not the entry point and described the incident as an external, sophisticated attack rather than human error by the bank. The bank said it detected suspicious activity, notified relevant authorities and took precautionary steps, including suspending some transactions. Its app was unavailable for several hours on Nov. 4, according to franceinfo, and the bank said almost all operations resumed that morning.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Route Was Targeted
The reported loss draws attention to a part of banking security that is less visible to customers: the institution’s own accounts and payment processes. Arkéa says the attackers did not take money from customer accounts. The incident nonetheless shows how a compromise involving a supplier can potentially reach a bank’s internal payment activity, creating financial and operational consequences even when retail deposits are not directly involved.
For banks and other organizations, the account used to move institutional funds and the systems of vendors with access to payment processes both require protection. The exact access path is still under investigation, so the incident does not establish which control failed or whether the same method could be used elsewhere. For customers, the bank’s warning about possible phishing is relevant: news of a major theft can be used by scammers to impersonate a bank and solicit passwords or verification codes.
The scale also makes the investigation important for determining whether funds can be traced, frozen or returned across institutions and, potentially, cryptocurrency platforms. Arkéa has confirmed that some funds were blocked, but it has not disclosed how much or where they were held. The eventual recovery figure could differ from the amount initially taken.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
The bank’s first public statement came on Nov. 4, 2026. Arkéa said it had been the victim of an attack that enabled fraudulent operations and that it had alerted the relevant supervisory and public authorities after detecting the incident. It filed a complaint with the Paris prosecutor, according to the bank’s statements summarized in the source reporting.
Later on Nov. 4, the bank issued a question-and-answer statement explaining that the attackers had used its own account and reached it through a service provider. It said the incident was contained and that customer assets were unaffected. The Paris prosecutor’s office confirmed to AFP that it had opened an investigation that morning. The case was assigned to the prosecutor’s cybercrime section and led by France’s anti-cybercrime office, according to the source material.
Reports of a roughly $133 million theft circulated before the bank gave its own estimate. On Nov. 5, Arkéa told Reuters that about €100 million was stolen. The bank is a cooperative group based in Brittany and includes the online bank Fortuneo; the attack disclosure is significant because Arkéa says the route involved its own institutional account, not the accounts of customers of its federations or subsidiaries.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 question-and-answer statement
The Provider and Recovery Remain Unknown
The bank has not named the service provider or explained precisely how the attackers used its platform. It has not disclosed when the intrusion began, the specific security weakness involved, or which transactions were made to which institutions. Those details are subject to the ongoing investigation.
The amount ultimately lost is also unresolved. Arkéa has said that some money was blocked, but it has not said how much, whether the blocked funds will be returned, or how much of the reported €100 million may be recoverable. The bank’s estimate is approximate, and earlier media reports of about €118 million were not confirmed by Arkéa.
The prosecutor’s investigation is examining the intrusion and the method used. The available information does not establish that customer data or customer accounts were compromised, and the bank says customer deposits are unaffected. It is not clear whether investigators have identified suspects or whether other organizations were affected through the same service provider.
Investigators Trace the Payment Chain
France’s anti-cybercrime office is leading the investigation opened by the Paris prosecutor’s cybercrime section. Investigators are expected to examine how the supplier platform was accessed, how the bank’s own account was used, and where the transactions went. Arkéa says it is working with judicial and police authorities to establish the attack’s origin and method.
The bank has said the incident is contained and that most operations resumed after precautionary suspensions on Nov. 4. Further updates will be needed to clarify the final loss, the status of blocked funds and whether any additional security measures are required. The provider’s identity and any findings about the access route have not been made public in the material available.
Customers should be alert to messages claiming to offer help or verify accounts in connection with the incident. Arkéa’s warning is that customers should watch for phishing; no bank should ask for a password or one-time SMS code in response to an unsolicited message or call. Businesses, meanwhile, will be watching for findings about supplier access and payment controls that may apply beyond this case.
Key Questions
Were customer accounts used in the theft?
No, according to Crédit Mutuel Arkéa. The bank says attackers used its own account and did not transact through customer accounts. It also says customer deposits are not affected.
How much money was stolen?
Arkéa told Reuters on Nov. 5 that around €100 million was stolen. The bank has not confirmed an earlier reported figure of about €118 million, and the final loss remains unclear.
How did the attackers reach the bank?
The bank says they came through the platform of one of its service providers. It has not named the provider or publicly detailed the technical method. Arkéa says Fortuneo was not the entry point.
Can the stolen money be recovered?
Arkéa says some funds have been blocked, but it has not given an amount or said how much will be returned. Recovery prospects remain uncertain while investigators trace the transactions.
What should customers do now?
Be cautious of messages or calls that use the incident to request account details. Do not share passwords or SMS verification codes in response to unsolicited contact, and use the bank’s official channels to check account information.
Source: ThorstenMeyerAI.com
