🔍 Read the full analysis: Crédit Mutuel Arkéa Hack: What Is Known So Far on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Crédit Mutuel Arkéa said on November 4 that attackers used the bank’s own account to make fraudulent transactions, and told Reuters the next day that around €100 million was stolen. The bank says customer accounts were not used and deposits are unaffected; investigators have not publicly identified the service provider or explained how the attack worked.
Crédit Mutuel Arkéa said on November 4 that attackers used the French bank’s own account to make fraudulent transactions, and told Reuters on November 5 that around €100 million was stolen. The bank says customer accounts were not used and customer deposits are unaffected; a Paris investigation is under way.
The bank’s November 4 statement said the attackers carried out transactions from Crédit Mutuel Arkéa’s own account to other banking institutions. It said they did not use accounts belonging to customers of its federations or subsidiaries. The bank also said some transactions were suspended as a precaution after the incident was detected, and that almost all operations resumed during the morning.
In a more detailed statement later that day, the bank said the attack came through the platform of one of its service providers. It has not identified that provider. The bank denied that its online subsidiary, Fortuneo, was the entry point and described the incident as an external, sophisticated attack. It also said it had notified relevant authorities and supervisory bodies.
The reported amount changed as information emerged. On November 4, the bank declined to confirm reports of $133 million, or about €118 million, saying it would validate only the order of magnitude. On November 5, it told Reuters the amount stolen was around €100 million. The bank said part of the money had been blocked; the final amount and any recovery remain uncertain.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from attacks in which criminals take money directly from individual customers. The bank says the funds came from its own account, while customer accounts were not used. That distinction matters to customers assessing whether their deposits are at risk, though the bank’s statements do not remove the need to watch for fraud attempts exploiting the news.
For financial institutions and other businesses, the disclosed route also puts attention on third-party service providers that can connect to systems or initiate financial activity. The precise access path has not been made public, so the case does not yet establish which controls failed or how broadly the method could apply. It does show why a company’s security review must account for suppliers as well as its own systems.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
Dyson Ball Animal 3 Upright Vacuum – Corded, 290 AW, De‑tangling Motorbar Cleaner Head, 3 Suction Modes
iRobot Roomba 105 Combo Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
The Disclosed Timeline So Far
The bank has not said when the attack began. A report in Le Figaro, cited in the supplied source material, says the incident began at a provider that had itself been affected at the end of October. The same report says information about the incident circulated on social media from November 1. These details are media reports, not facts confirmed by the bank.
On the morning of November 4, according to the bank, it detected suspicious activity, notified relevant bodies and suspended some transactions as a precaution. franceinfo reported that the banking app was unavailable for several hours. The bank issued a public statement at 1 p.m. saying the incident was contained and customer assets were unaffected, then published a more detailed question-and-answer statement at 5:30 p.m. The Paris prosecutor’s office confirmed that it had opened an investigation that morning.
The case is being handled by the prosecutor’s cybercrime section, with France’s anti-cybercrime office leading the investigation, according to the source material. The bank’s group includes the Brittany and South-West federations of Crédit Mutuel and subsidiaries including Fortuneo. Its size helps explain the incident’s reach, but the immediate facts remain the specific attack on the bank’s own funds and the ongoing investigation.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued November 4
The Provider and Recovery Remain Unknown
Several central details have not been disclosed. The bank has not named the service provider, described the technical weakness or access method, or said when the intrusion started. Investigators have not publicly identified suspects or explained whether the transfers were enabled by stolen credentials, compromised systems or another route.
The final financial loss is also unsettled. The bank told Reuters that around €100 million was stolen and said some funds had been blocked, but it has not provided a final accounting or said how much may be recovered. Reports of an earlier start date and social-media discussion rely on media accounts and should not be treated as bank-confirmed chronology.
The bank says customer accounts were not used and deposits were unaffected. The scope of any data exposure, the effect on the unnamed provider and whether further operational disruption is possible have not been detailed in the supplied information.
Investigators Trace the Transfers
The Paris prosecutor’s investigation is intended to establish the origin and method of the attack. Authorities and the bank may provide further information about the provider, the transactions and any recovery of funds as the inquiry progresses. No public timetable for those updates is available.
For customers, the bank’s warning about possible phishing attempts is the immediate practical point. Treat unsolicited messages about the incident with caution, and do not share passwords or SMS verification codes in response to calls, texts or emails claiming to be from the bank. Businesses should review which suppliers can access payment-related systems, while avoiding assumptions about the precise failure until investigators disclose more.
Key Questions
Were customer accounts used in the Crédit Mutuel Arkéa attack?
The bank says no. It said the attackers used the bank’s own account and did not go through customer accounts at its federations or subsidiaries.
How much money was stolen?
On November 5, Crédit Mutuel Arkéa told Reuters that around €100 million was stolen. The bank said some funds had been blocked, but it has not given a final loss or recovery figure.
How did the attackers reach the bank?
The bank said the attackers came through the platform of one of its service providers and denied that Fortuneo was the entry point. It has not named the provider or described the technical method.
Is the incident under investigation?
Yes. The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4, according to the source material. France’s anti-cybercrime office is leading the inquiry.
What should customers do now?
Be alert for messages using the incident to solicit login details or verification codes. The bank says customer deposits are unaffected; customers should not share passwords or SMS codes with anyone contacting them unexpectedly.
Source: ThorstenMeyerAI.com
