🔍 Read the full analysis: Arkéa Says About €100 Million Was Stolen In Hack on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through transactions from the bank’s own account, using a service provider’s platform. The bank says customer accounts were not used and deposits are unaffected; some funds have been blocked, but the amount recoverable and the attack’s full mechanics remain unknown.
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen after attackers used a service provider’s platform to make transactions from the French bank’s own account. The bank says no customer accounts were used and customer deposits are not affected; prosecutors have opened an investigation into the incident.
The bank’s account of the incident, issued in a question-and-answer statement on Nov. 4, says the attackers used Crédit Mutuel Arkéa’s own account to send money to other banking institutions. The bank said those transfers may have allowed the funds to be converted into cryptocurrency through specialist platforms. That possible conversion route has not been independently established in the material available.
Arkéa said the attackers reached it through the platform of one of its service providers. It has not named the provider. The bank said Fortuneo, its online banking subsidiary, was not the entry point, and described the incident as an external attack rather than human error by its staff. It said its systems detected suspicious activity and that the attack was contained.
On Nov. 5, the bank told Reuters that around €100 million was stolen. The day before, it had declined to confirm a reported figure of $133 million, or about €118 million, saying it would validate only the order of magnitude. The bank said some funds had been blocked. It has not given a final accounting of the loss or said how much money may be recovered.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from fraud in which criminals take money directly from customers. According to Arkéa, the transfers came from a bank-owned account, while customer accounts were not involved. The distinction matters to customers assessing whether their balances are at risk, and to companies considering how payment systems are protected.
The disclosed route also points to a risk beyond an institution’s internal network: a supplier platform with a role in its operations may create a path to sensitive financial processes. Arkéa has not explained what access the provider had or how it was compromised, so the incident does not yet establish the precise weakness. It does show why banks and other organizations need to review third-party access to payment and treasury systems, as well as controls on transfers from their own accounts.
For customers, the bank’s statements that deposits are unaffected and customer accounts were not used are reassuring but do not remove the risk of follow-on scams. Attackers may exploit public attention by posing as bank staff. Customers should treat unexpected messages requesting passwords or one-time codes as suspicious and contact the bank through its official channels.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
As an affiliate, we earn on qualifying purchases.
What Arkéa Has Disclosed So Far
Arkéa, based near Brest in Brittany, includes the Crédit Mutuel federations of Brittany and the South-West, along with subsidiaries including Fortuneo. The group reports more than 5.8 million members and customers and total assets of €211.5 billion. Those figures describe the scale of the institution; they do not indicate that customer deposits were affected in this incident.
The bank said it informed the relevant supervisory and competent bodies after detecting the attack on Nov. 4, suspended some transactions as a precaution and filed a complaint with the Paris prosecutor. It said almost all operations resumed that morning. France’s public broadcaster franceinfo reported that the banking app was unavailable to customers for several hours. The bank later characterized the incident as contained.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organized intrusion into a data-processing system. France’s anti-cybercrime office is leading the inquiry, according to the supplied reporting. Earlier accounts about when the attack began and when information started circulating online were attributed to press reports, not confirmed by the bank; Arkéa has not publicly set out a full timeline.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
The Route and Recovery Remain Unknown
Key details remain unsettled. Arkéa has not identified the service provider, described how attackers gained access to its platform, or explained what permissions allowed transactions to reach the bank’s account. The exact start date, the sequence of transfers and the full amount involved have not been publicly established.
The reported €100 million is an approximate figure given to Reuters, not a final audited loss. The bank has said that some funds were blocked, but has not said how much, where the money is now, or whether it can be returned. The bank’s statement that transfers may have enabled conversion into cryptocurrency is not confirmation that all or any specific share of the funds was converted.
The investigation may clarify whether the provider’s systems, credentials or another part of the payment chain were compromised. Until authorities and the bank release further findings, claims about the attackers’ identity, precise method and total recoverable funds remain unconfirmed.
Investigators Trace the Transfers
The Paris prosecutor’s investigation, led by France’s anti-cybercrime office, is expected to examine how the attackers entered through the supplier platform, how the transfers were authorized and where the money went. Arkéa says it is cooperating with judicial and police authorities and has informed relevant banking supervisors.
The next public milestones are likely to be an updated accounting of the loss, information on funds blocked or recovered, and details about the provider and the breach route. The bank has not announced a date for those disclosures. Customers should follow official Arkéa communications and remain alert for messages that use the incident to solicit passwords, banking details or SMS codes.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts used?
The bank says no. It said the attackers used an account belonging to Crédit Mutuel Arkéa and did not go through customer accounts at its federations or subsidiaries. The bank also said customer deposits were not affected.
How much money was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. The bank has not provided a final figure. It had earlier declined to confirm a report of €118 million.
How did the attackers reach the bank?
Arkéa said they came through the platform of one of its service providers. The bank has not named the provider or explained how attackers accessed the platform. It said Fortuneo was not the entry point.
Can the stolen money be recovered?
The bank said some funds were blocked, but it has not disclosed the amount or said how much can be recovered. The outcome depends in part on tracing the transfers and the ongoing investigation.
What should customers do now?
Arkéa says customer assets are unaffected, but customers should be cautious about phishing that invokes the incident. Do not share passwords or SMS verification codes in response to unsolicited messages; contact the bank using its official app, website or phone number.
Source: ThorstenMeyerAI.com
