TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said on 4 November 2026 that attackers used the bank’s own account to make fraudulent transactions through a service provider. The bank told Reuters the next day that around €100 million was stolen; the final amount and recovery total remain unknown.
French cooperative bank Crédit Mutuel Arkéa said on 4 November that attackers used the bank’s own account to carry out fraudulent transactions through a service provider. The bank told Reuters on 5 November that around €100 million was stolen; it says customer accounts were not used and customer deposits are unaffected.
The bank said it detected the attack on 4 November and notified the relevant authorities and supervisory bodies. It suspended some transactions as a precaution, then said that almost all operations resumed during the morning. The banking app was unavailable for several hours, according to franceinfo. In a statement at 13:00, the bank said the incident was “closed and under control” and warned customers about possible phishing.
A question-and-answer statement issued at 17:30 said the attackers had used Crédit Mutuel Arkéa’s own account to send transactions to other banking players, and had accessed it “through the platform of one of our service providers”. The bank has not identified that provider. It denied that its online bank, Fortuneo, was the point of entry and ruled out human error on its side.
The reported sum changed as more information emerged. On 4 November, the bank declined to confirm reports of $133 million, or about €118 million, saying it would “validate the order of magnitude”. The next day it told Reuters that around €100 million had been stolen. Some funds have been blocked, but the bank has not provided a final accounting.
Crédit Mutuel Arkéa Hack What the timeline shows
Attackers used the bank’s own account through a service provider. The bank says customer deposits were unaffected.
How the incident unfolded
The bank described the access route and response in updates on 4 November.
What the bank says
The disclosed route points to a supplier platform, while key details remain unknown.
The bank’s own funds
Arkéa says transactions came from its account, not customer accounts, and deposits were unaffected.
A service provider
The provider has not been named, and the technical method has not been disclosed.
Ruled out as entry point
The bank denied that its online bank Fortuneo was used to gain access.
What remains unsettled
The bank and investigators have not published a final account of the incident.
- Around €100 million stolen, according to the bank’s statement to Reuters.
- Some funds have been blocked.
- Almost all operations resumed on 4 November.
- Final loss and recovery totals.
- When the attack began and how the provider platform was breached.
- Which provider was involved.
What investigators will examine
The Paris prosecutor’s cybercrime section opened an investigation on 4 November, led by France’s anti-cybercrime office.
Establish how attackers reached the bank’s account through the service provider.
Examine transfers sent to other banking players and how they were authorised.
Determine what was blocked, recovered, and ultimately lost.
Why the Bank’s Own Account Matters
The incident shows that a bank’s internal accounts and payment processes can be targets in their own right. The bank says the funds came from its account rather than customer accounts, but a loss of this size could still have consequences for the institution while investigators establish how the transactions were initiated and whether money can be recovered.
The alleged route through a service provider also puts attention on supplier access to financial systems. Companies that allow vendors to connect to payment platforms may need to review permissions, transaction checks and how quickly access can be suspended. The exact weakness in this case has not been disclosed, so the incident does not establish how the provider’s platform was compromised.
For customers, the bank says deposits were unaffected. It has also warned of phishing risk: criminals may use news of the attack to pose as bank staff and request passwords or one-time codes. Customers should treat unsolicited requests for such credentials with suspicion.
Products Worth Considering
Apple MacBook Pro MPHF3LL/A 14.2-Inch Laptop | M2 Pro 12-Core Chip 16GB Unified Memory 1TB SSD | 19-Core GPU Liquid Retina XDR Display Space
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Supplier Route, Not Fortuneo
Crédit Mutuel Arkéa is based near Brest in Brittany and brings together the Crédit Mutuel federations of Brittany and the South-West, as well as about 40 subsidiaries, including online bank Fortuneo. The source material says the group reports more than 5.8 million members and customers and total assets of €211.5 billion.
The bank’s account of the access route narrows the focus to a service provider’s platform. Arkéa has not named the provider or described the technical steps used to reach its account. Its statements reject Fortuneo as the entry point, but detailed findings will depend on the investigation.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of 4 November into suspected organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation. Early reports of $133 million and descriptions of the event as unprecedented came from media outlets and security sources; they are not findings established by the bank or investigators in the material available here.
““The victim of an attack that enabled fraudulent operations.””
— Crédit Mutuel Arkéa
The Attack’s Start and Final Cost
The bank has not said when the attack began, how the supplier platform was breached, or which provider was involved. Le Figaro reported that the provider was attacked at the end of October and that information circulated on X from 1 November, but those details have not been confirmed by the bank.
The final amount taken and the amount recovered are also unsettled. The bank told Reuters the theft was around €100 million and said some funds had been blocked; it has not given a final figure or said how much, if any, has been returned. The investigation may establish how the transactions were authorised and whether other systems or accounts were affected.
Investigators Trace the Transactions
France’s anti-cybercrime office is leading the case opened by the Paris prosecutor’s cybercrime section. Investigators will seek to establish how attackers gained access through the service provider, trace the transactions sent to other banking players and determine what funds can be recovered.
Arkéa has said the incident is under control and that almost all operations resumed on 4 November. The next public updates that could clarify the impact are a final accounting of the loss and recovery, more detail on the supplier route, and any findings shared by prosecutors or the bank.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on 5 November that around €100 million was stolen. Some funds have been blocked, but the final loss and recovery totals have not been disclosed.
Were customer accounts or deposits affected?
Arkéa said attackers used the bank’s own account, not customer accounts, and said customer deposits were unaffected.
How did the attackers reach the bank’s account?
The bank said the attackers came through a service provider’s platform. It has not named the provider or explained the technical method. Arkéa said Fortuneo was not the entry point.
When did the attack start?
The bank has not given a start time. Le Figaro reported that the provider was attacked at the end of October, but that account has not been confirmed by Arkéa.
What is happening now?
France’s anti-cybercrime office is leading an investigation opened by the Paris prosecutor’s cybercrime section. Investigators are examining the intrusion and transactions, while the bank says almost all operations resumed on 4 November.
Source: Thorsten Meyer AI
