🔍 Read the full analysis: Crédit Mutuel Arkéa Confirms €100 Million Theft on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa told Reuters on November 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers accessed it through a service provider, not customer accounts or its online bank Fortuneo; authorities are investigating, and the final loss remains unknown.
French cooperative bank Crédit Mutuel Arkéa said about €100 million was stolen in fraudulent transactions from the bank’s own account, according to a statement it gave Reuters on November 5. The bank says attackers reached that account through a service provider’s platform, not through customer accounts or its online bank Fortuneo; French authorities have opened an investigation.
The bank first disclosed an attack on November 4, describing it as an incident that enabled fraudulent operations. In a more detailed statement later that day, it said attackers used Crédit Mutuel Arkéa’s own account to make transactions to other financial institutions. It said customer accounts were not used and customer deposits were not affected.
On November 5, the bank told Reuters that around €100 million had been stolen. The figure is an estimate, not a final accounting. The bank had earlier declined to confirm reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. It also said some of the money had been blocked. How much remains recoverable, and the final amount lost, have not been established in the material available.
Arkéa said the attackers came through a platform operated by one of its service providers, without naming the provider. It ruled out Fortuneo as the point of entry and said the incident was an external, sophisticated attack rather than human error on its side. The bank said it had alerted relevant supervisory bodies and authorities, suspended some transactions as a precaution, and resumed almost all operations during the morning of November 4.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why a Bank’s Own Account Was Targeted
The incident highlights that a bank’s payment infrastructure can be a target even when customers’ accounts are not accessed. Arkéa says the transactions originated from its own account and were sent to other banking players. It said those transfers could potentially have allowed the money to be converted into cryptocurrency through specialist platforms, but that description does not establish that all or any specific amount was converted.
The reported loss also puts attention on third-party access and payment controls. A supplier with a connection to financial systems can create risk beyond the supplier’s own business. For customers, Arkéa’s statements indicate that deposits were not affected, but the incident may prompt scam attempts that exploit concern about the breach. The bank advised customers to be alert to phishing.
The scale of the theft is based on the bank’s estimate to Reuters, while the recovery outcome remains uncertain. The distinction matters: the amount transferred, the amount ultimately lost, and any sum recovered are separate figures, and the final accounting has not been provided.
Products Worth Considering
Samsung Odyssey G4 25-inch FHD Gaming Monitor
Dell XPS 13 9345 Laptop, 13.4-Inch FHD+ 120Hz, Snapdragon X Elite, 32GB RAM, 1TB SSD
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the November Timeline Developed
The bank has not stated when the intrusion began. A November 5 report by Le Figaro, as described in the source material, said the incident started at a service provider that had itself been attacked near the end of October. That timeline is reported, not confirmed by Arkéa. The same report said information began circulating on X from November 1; this account also has not been confirmed by the bank.
By the morning of November 4, media reports were describing a theft of about $133 million. At 10:29 a.m. that day, franceinfo reported more than €100 million stolen, citing a source close to the case. Arkéa’s first public statement, issued at about 1 p.m., said the incident was contained and customer assets were unaffected. A later question-and-answer statement explained that the bank’s own account and a service provider were involved.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4, according to the source material. The case concerns suspected organised intrusion into a data processing system and is being led by France’s anti-cybercrime office. The bank says it is working with police and judicial authorities to establish the attack’s origin and method.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa
The Loss and Entry Route Remain Under Review
The final financial loss is not known. Arkéa told Reuters the amount stolen was around €100 million and said some funds had been blocked, but it has not specified how much was recovered or remains missing. Its earlier response to the reported €118 million figure was that it could validate only the order of magnitude.
The bank has not named the service provider or disclosed how attackers used its platform to reach the bank’s account. It has also not said when the attack began. Reports placing the start in late October and the first circulation of information on November 1 are not confirmed by the bank. Investigators have yet to establish the origin, precise method, or full scope of the incident publicly.
Investigators Trace Transfers and Access
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the suspected intrusion. Arkéa says it is cooperating with authorities to determine how access was obtained and how the fraudulent transactions were carried out. Further updates may clarify the supplier’s role, the total sum affected, and whether blocked funds can be returned.
The bank has said the incident is contained and that almost all operations resumed on November 4. Customers should rely on direct communications from the bank and treat unexpected messages about the attack cautiously. The source material warns that a bank will not ask customers for passwords or SMS security codes; readers should not share those details in response to calls, texts, or emails.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on November 5 that around €100 million was stolen. It has not provided a final figure, and some money has reportedly been blocked.
Were customer accounts or deposits affected?
Arkéa said attackers used the bank’s own account, not customer accounts, and said customer deposits were not affected.
How did the attackers reach the bank?
The bank said they came through a service provider’s platform. It has not identified the provider or publicly explained the full technical method.
Was Fortuneo involved as the entry point?
Arkéa said Fortuneo was not the entry point. Fortuneo is the group’s online bank.
Can the stolen money be recovered?
The bank said some funds were blocked, but it has not said how much can be recovered. The recovery total remains unclear while authorities investigate.
Source: ThorstenMeyerAI.com
