TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said on November 5 that attackers stole around €100 million from the French bank’s own account through a service provider’s platform. The bank says customer accounts and deposits were unaffected; some funds have been blocked, but the recoverable amount is unknown.
French cooperative bank Crédit Mutuel Arkéa said on November 5 that attackers stole around €100 million from the bank’s own account, using a platform operated by one of its service providers to send transactions to other banks. The bank says no customer accounts were used and customer deposits were unaffected; authorities are investigating how the transfers were carried out.
The bank first disclosed an attack on November 4, describing it as an incident that enabled fraudulent operations. In a later question-and-answer statement, it said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players” and gained access “through the platform of one of our service providers.” The bank has not named the provider.
On November 5, Arkéa told Reuters that around €100 million had been stolen. Earlier reports cited a figure of $133 million, or about €118 million. The bank had declined to confirm that specific amount, saying it could “validate the order of magnitude.” It said some money had been blocked, but the final loss and the amount that may be recovered remain unknown.
Arkéa said it notified relevant authorities and supervisory bodies when the attack was detected and suspended some transactions as a precaution. Its banking app was unavailable for several hours on November 4, franceinfo reported. The bank said “almost all operations” resumed that morning, and later described the incident as closed and under control. That statement addresses the immediate incident; it does not establish how much money will ultimately be recovered.
Arkéa says €100 million was stolen through a provider platform
Attackers transferred money from Crédit Mutuel Arkéa’s own account. The bank says customer accounts and deposits were unaffected.
Where the money came from
The bank says attackers used a service provider’s platform to send transfers to other banks.
- Used to carry out the transactions
- Some funds have been blocked
- Not used for the transfers
- Deposits were unaffected, the bank says
What remains unknown
The public statements do not yet explain how the provider platform was compromised.
Not named
Arkéa has not identified the service provider involved.
Amount unclear
Some money was blocked, but the recoverable amount and final loss are unknown.
What the investigation must establish
Authorities are tracing the access route, those responsible and the transfers.
Determine how attackers gained access through the provider’s platform.
Establish where the money went and what can be recovered.
Identify how payment controls were bypassed or failed.
A Breach of Bank Payment Controls
The case draws attention to a risk that can sit outside customer accounts: access to a bank’s own payment processes. Arkéa says the route involved a service provider’s platform, showing why companies must account for suppliers that can initiate or support financial transactions. The precise technical weakness and the controls involved have not been made public.
For customers, the bank’s statement that deposits were unaffected is the clearest reassurance available so far. The incident may also be used in phishing attempts, with criminals posing as bank staff or investigators. Arkéa advised customers to remain alert; people should not share passwords or one-time codes in response to unsolicited contact.
Popular right now
Dyson V15 Detect Cordless Vacuum
De'Longhi Rivelia Fully Automatic Espresso Machine with Milk Frother, White
Ninja Mega Kitchen System Blender and Food Processor, 1500W, 72-oz Pitcher, 8-Cup Bowl, Black (BL770)
As an affiliate, we earn on qualifying purchases.
What the Timeline Shows
The bank has not said when the intrusion began. Le Figaro reported that a service provider was attacked in late October and that information about the incident began circulating on X from November 1. Those details are media reports, not a timeline confirmed by Arkéa.
By the morning of November 4, cryptocurrency news outlets and Le Télégramme were reporting a possible $133 million loss, according to Reuters. At 10:29 that day, franceinfo reported a theft of more than €100 million, citing a source close to the case. Arkéa issued its first public statement at 13:00 and a more detailed question-and-answer release at 17:30. That evening, the Paris prosecutor’s office confirmed to AFP that it had opened an investigation that morning.
On November 5, the bank gave Reuters its estimate of around €100 million and said it had informed the European Central Bank, French banking supervisors and prosecutors. Arkéa is based near Brest and includes the online bank Fortuneo. The bank has denied that Fortuneo was the entry point and said the incident did not result from human error on its side.
““Used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.””
— Crédit Mutuel Arkéa
The Loss and Entry Point
Several key details remain undisclosed. Arkéa has not named the service provider, explained how its platform was compromised, or specified when attackers first gained access. The bank’s estimate of around €100 million is not a final accounting, and it has not said how much of the money blocked so far can be returned.
It is also unclear from the public statements which payment controls failed or how investigators are tracing the transfers. Reports about a late-October provider breach and posts circulating from November 1 have been attributed to Le Figaro and have not been confirmed by the bank. The investigation may clarify those points.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section opened a case on the morning of November 4 involving an alleged organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation. Authorities will seek to establish how the access was obtained, who was responsible and where the transferred funds went.
Arkéa has said that some funds were blocked and that it notified European and French supervisors. Further information on the provider, the final loss and any recovery may emerge as the investigation and the bank’s accounting continue. Customers should follow notices from the bank through official channels and ignore unsolicited requests for passwords or SMS codes.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank says customer accounts were not used and customer deposits were unaffected. It said the transactions came from Arkéa’s own account.
How much money was stolen?
On November 5, Arkéa told Reuters that around €100 million had been stolen. Earlier reports cited about €118 million, but the bank did not confirm that specific figure. The final amount is not known.
How did the attackers get access?
Arkéa said the attackers used the platform of one of its service providers. It has not named the provider or explained the technical details. The bank said Fortuneo was not the entry point.
Can the stolen money be recovered?
The bank said some funds had been blocked, but it has not stated how much can be recovered. The amount and destination of the remaining funds are unclear.
What should customers do now?
Arkéa advised customers to watch for phishing. Do not share passwords or SMS codes with anyone who contacts you unexpectedly, even if they claim to represent the bank.
Source: Thorsten Meyer AI
