🔍 Read the full analysis: Crédit Mutuel Arkéa Says About €100M Was Stolen on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said attackers used a service provider’s platform to reach the bank and carry out fraudulent transfers from its own account. On November 5, the bank told Reuters that about €100 million was stolen; it says customer accounts and deposits were not affected, and some money has been blocked.
Crédit Mutuel Arkéa said attackers used a service provider’s platform to reach the French bank and make fraudulent transfers from the bank’s own account, not customer accounts. On November 5, it told Reuters that about €100 million was stolen; the bank says customer deposits were not affected, while investigators work to establish how the intrusion occurred.
The bank disclosed the attack on November 4, saying it had been “the victim of an attack that enabled fraudulent operations.” In a more detailed statement later that day, it said the attackers used a Crédit Mutuel Arkéa account to send transactions to other banking institutions. Those transactions could then potentially have been converted into cryptocurrency through specialist platforms, the bank said. That possible conversion route is the bank’s account of the activity, not a publicly established tracing of the funds.
Arkéa said the attackers reached it through the platform of a service provider. It has not publicly named the provider. The bank said Fortuneo, its online banking subsidiary, was not the entry point and described the incident as an external, sophisticated attack rather than human error on its part. It said its systems detected suspicious activity quickly and that it was working with judicial and police authorities.
On November 4, the bank said it had alerted relevant supervisory bodies and suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to franceinfo; the bank said almost all operations resumed that morning. The bank later described the incident as contained. On November 5, it told Reuters that around €100 million had been stolen and that part of the money had been blocked. Earlier reports put the figure at €118 million, but the bank had declined to confirm that amount, saying it would validate only the order of magnitude. The final loss has not been established publicly.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Routes Were Targeted
The incident differs from fraud in which criminals take money directly from customers. Arkéa says the transfers came from the bank’s own account, while customers’ accounts were not used and their deposits were not affected. That distinction matters to customers, but it does not make the incident minor: a large bank’s own funds and payment processes can be targets even when retail accounts remain untouched.
The reported route through a supplier also puts attention on third-party access. A service provider’s platform can form part of a bank’s operational chain, and the incident shows why organizations need to review which external platforms can initiate or support financial activity. The precise weakness, access path and controls involved have not been disclosed, so the case does not yet establish how another institution could apply the lesson.
For customers, the immediate concern is also the risk of follow-on scams. Arkéa warned customers to be alert to phishing. Criminals may use a widely reported incident to pose as bank staff and seek passwords or one-time verification codes. The bank has said customer deposits were unaffected; customers should treat unexpected requests for credentials as suspicious.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, 12MP Center Stage Camera, Touch ID, Wi-Fi 7, Midnight
Samsung Galaxy Tab A11+ 11-Inch Tablet, 6GB RAM, 128GB Storage, Expandable, Gray
Bose SoundLink Plus Portable Bluetooth Speaker, Black
As an affiliate, we earn on qualifying purchases.
The November 4 Disclosure Timeline
The bank has not said when the attack began. Its public account establishes a response and disclosure timeline, but not the full chronology of the intrusion. On the morning of November 4, Arkéa said it notified competent and supervisory bodies as soon as the attack was detected and suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor, according to its statements.
At about 1 p.m. on November 4, the bank issued a statement saying the incident was closed and under control, and that customer assets were not affected. A later question-and-answer statement that day set out the bank’s account of the source, the use of its own account, and Fortuneo’s non-involvement. That evening, the Paris prosecutor’s office confirmed to AFP that an investigation had been opened that morning.
Some earlier details remain media reports rather than facts confirmed by the bank. Le Figaro reported that the attack began at a provider that had itself been hit in late October, and that information about the incident circulated on X from November 1. Those points have not been confirmed in the bank’s public statements. The Paris prosecutor’s cybercrime section opened an investigation into suspected organised intrusion into an information system, led by France’s anti-cybercrime office.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa
The Provider and Final Loss Remain Unknown
Several central details remain undisclosed. Arkéa has not identified the service provider, explained which systems or permissions were involved, or said when the attackers first gained access. Its statements also do not describe the full sequence of transfers or how investigators are tracing them.
The amount is still an estimate. The bank told Reuters that about €100 million was stolen and said some funds had been blocked, but it has not given a final net-loss figure or said how much may be recovered. Earlier reporting cited €118 million, which the bank did not confirm. The investigation may clarify the amount and the route taken by the money, but no final findings are available.
Claims that the incident began with an attack on the provider, or that information circulated online before November 4, remain attributed to media reporting rather than confirmed bank findings. It is also not clear whether the attack affected any other organizations connected to the provider.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section is investigating, with France’s anti-cybercrime office leading the work. Investigators are expected to establish the intrusion’s origin, the provider’s role and the transaction path. Arkéa says it is cooperating with judicial and police authorities and has notified European and French banking supervisors.
The next public milestones are likely to be updates on the investigation, the amount ultimately lost and any funds recovered or blocked. The bank has not provided a timetable for those findings. Until further details are released, the exact technical cause and the identity of the supplier remain unconfirmed.
Customers should follow information from the bank through official channels and be wary of messages claiming to offer help with the incident. No one should share a password or SMS verification code in response to an unsolicited call, text or email.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts affected?
The bank says the attackers used its own account, not accounts belonging to customers of its federations or subsidiaries. It has said customer deposits were not affected.
How much money was stolen?
On November 5, the bank told Reuters that about €100 million was stolen. Some money has been blocked, but the final loss and recoverable amount have not been disclosed. The bank did not confirm an earlier reported figure of €118 million.
How did attackers reach the bank?
Arkéa says the attackers came through a service provider’s platform. It has not named the provider or publicly explained the specific vulnerability. The bank says Fortuneo was not the entry point.
What happens next in the investigation?
The Paris prosecutor’s cybercrime section opened an investigation on November 4, led by France’s anti-cybercrime office. Investigators are working to establish the attack’s origin and method; no timetable for a final account has been announced.
Source: ThorstenMeyerAI.com
