🔍 Read the full analysis: Arkéa Says About €100 Million Was Stolen on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that attackers stole around €100 million using the bank’s own account, after gaining access through a service provider’s platform. The bank says customer accounts and deposits were not affected; some funds have been blocked, but the final loss and the attack’s full mechanics remain unknown.
Crédit Mutuel Arkéa said on Nov. 5 that attackers stole around €100 million after using the French bank’s own account to make fraudulent transfers through other banking players. The bank says the attackers reached it through a service provider’s platform, not customer accounts, and that customer deposits were not affected.
The bank first disclosed the attack on Nov. 4, describing it as an incident that enabled fraudulent operations. In a more detailed statement later that day, it said the attackers used Crédit Mutuel Arkéa’s own account to send transactions to other financial institutions. The bank said those transactions may have allowed the funds to be converted into cryptocurrency through specialist platforms.
On Nov. 5, Arkéa told Reuters that around €100 million had been stolen. The bank had earlier declined to confirm reports of $133 million, equivalent to about €118 million, saying it could only validate the order of magnitude. It has said that part of the money has been blocked; the amount ultimately lost is not yet established.
Arkéa said the attackers entered through the platform of one of its service providers, which it has not named. It said Fortuneo, its online banking subsidiary, was not the entry point, and characterized the attack as external rather than the result of an internal human error. The bank said suspicious activity was identified quickly and that the incident was contained. It has not published technical details explaining how the provider’s platform was used or how the transfers were authorized.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The reported theft highlights a risk beyond familiar scams aimed at individual customers: financial institutions’ own payment and treasury systems can be targets. Arkéa says customer accounts were not used, but the incident involved funds belonging to the bank and transactions routed through other banking players. That distinction matters to customers, who may want to know whether their deposits or access to services were affected, and to financial firms reviewing how payments can be initiated through outside platforms.
The service-provider link also points to the wider security exposure created when organizations rely on external technology or payment services. A supplier’s access can create a route into a bank’s operations, although Arkéa has not disclosed the provider, the specific access involved, or whether other organizations may have been exposed. The case is under investigation, so its implications for controls and oversight cannot yet be determined.
For customers, the bank’s statements offer reassurance about the reported scope, not a guarantee that there will be no disruption or follow-on scams. Arkéa warned customers to watch for phishing. Messages or calls that exploit news of the attack should be treated cautiously; customers should not share passwords or one-time security codes in response to unsolicited contact.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel
iRobot Roomba 105 Combo Robot Vacuum and Mop
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
Arkéa’s first public statement on Nov. 4 said it had been the victim of an attack enabling fraudulent transactions. The bank said it notified relevant authorities and supervisory bodies after detecting the incident and suspended some transactions as a precaution. French media reported that its banking app was unavailable for several hours that day; the bank said most operations resumed during the morning.
In a statement later on Nov. 4, Arkéa clarified that the transactions came from its own account and that the path into the bank involved a service provider. It also said the online bank Fortuneo was not the entry point. These statements are the bank’s account of the incident; the detailed technical sequence has not been made public.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into alleged organized intrusion into a data-processing system, according to the source material. France’s anti-cybercrime office is leading the inquiry. The investigation is intended to establish the attack’s origin and method; no findings have been reported in the supplied information.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
The Loss and Attack Path
The final financial loss is not known. Arkéa has said around €100 million was stolen and that part of the funds has been blocked, but it has not said how much is recoverable or when that will be determined. The earlier €118 million figure reported by some outlets was not confirmed by the bank.
The bank has not named the service provider or explained how attackers gained access to its platform, what controls were bypassed, or how they were able to initiate the transfers. It is also unclear whether the money was converted into cryptocurrency; Arkéa described that as a possibility. The prosecutor’s inquiry is ongoing, and no suspects or investigative conclusions are identified in the available information.
Arkéa says customer accounts and deposits were not affected. The extent and duration of any service disruption, and whether the investigation will identify wider exposure involving the supplier or other institutions, remain unclear.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the intrusion and the fraudulent transactions. The inquiry is expected to examine how the provider platform was accessed, how the bank’s account was used, and where the funds went. Arkéa says it is cooperating with judicial and police authorities, but has not announced a timetable for further findings.
The bank may provide additional information about the amount recovered, the service-provider route, or the status of its systems as those details are established. For now, customers should rely on communications from the bank’s official channels and avoid responding to messages asking for passwords or SMS security codes. Businesses can treat the incident as a reminder to review supplier access and payment authorization controls, without assuming that the specific method used against Arkéa is known.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
On Nov. 5, the bank told Reuters that around €100 million was stolen. It has not confirmed the higher €118 million figure reported earlier, and the final loss remains uncertain because some funds have been blocked.
Were customer accounts or deposits affected?
Arkéa says the attackers used the bank’s own account, not customer accounts, and that customer deposits were not affected. The bank has not reported customer funds being taken in the incident.
How did the attackers get into the bank?
The bank says the attackers came through the platform of one of its service providers. It has not named the provider or disclosed the technical method used. Arkéa says Fortuneo was not the entry point.
Has the stolen money been recovered?
Arkéa says part of the funds has been blocked, but it has not stated how much or whether the blocked money will be returned. The recoverable amount is not yet known.
What happens next in the investigation?
The Paris prosecutor’s cybercrime section opened an investigation on Nov. 4, led by France’s anti-cybercrime office. Investigators are examining the intrusion and transactions; no conclusions or suspects have been reported in the available information.
Source: ThorstenMeyerAI.com
