🔍 Read the full analysis: The €100 Million Arkéa Hack: What Happened At The Bank? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers accessed it through a service provider, not Fortuneo or customer accounts; part of the money has been blocked, while the final amount and recovery prospects remain unknown.
French cooperative bank Crédit Mutuel Arkéa said on November 5 that attackers stole about €100 million through fraudulent transfers from an account belonging to the bank, after reaching it through a service provider’s platform. The bank says customer accounts were not used and customer deposits are unaffected; authorities are investigating how the attack was carried out.
In a statement issued November 4, Arkéa said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” The bank said those transfers may have allowed the funds to be converted into cryptocurrency through specialist platforms. It has not publicly identified the service provider or described the technical method used to access its systems.
On November 5, Arkéa told Reuters that around €100 million was stolen. The bank had earlier declined to confirm a reported figure of $133 million, equivalent to about €118 million, saying it would validate only the order of magnitude. The final amount remains unconfirmed, and the bank says some of the money has been blocked.
Arkéa said it detected suspicious activity, notified relevant authorities and supervisors, and suspended some transactions as a precaution on November 4. Its banking app was unavailable for several hours, according to franceinfo, while the bank said almost all operations resumed that morning. The bank described the attack as contained, but the investigation into its origin and method continues.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Routes Were Targeted
The incident differs from thefts in which criminals take money directly from individual customers. Arkéa says the transfers came from a bank-owned account, making the security of internal payment processes and third-party access central to the case. It also illustrates how a supplier with a connection to a financial institution can become part of the institution’s security exposure.
For customers, the bank’s statements offer a distinction between the reported loss and the status of personal deposits: Arkéa says customer funds were not affected. That does not remove the risk of follow-on scams. People may receive messages or calls exploiting the news, and the bank has warned customers to watch for phishing. Readers should not share passwords or SMS verification codes in response to unsolicited contact.
The financial consequences are not yet fully known. Part of the money has reportedly been blocked, but the bank has not given a final loss figure or said how much can be recovered. The incident’s broader implications for banks and suppliers will depend on what investigators establish about the access route and controls involved.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, 12MP Center Stage Camera, Touch ID, Wi-Fi 7, Midnight
Apple MacBook Air 15-inch with M5 chip, 16GB memory, 512GB SSD, and Liquid Retina display (Midnight)
As an affiliate, we earn on qualifying purchases.
What Arkéa Has Disclosed So Far
Arkéa is a cooperative banking group based near Brest in Brittany. The source material says it includes the Crédit Mutuel federations of Brittany and the South-West and about 40 subsidiaries, including online bank Fortuneo. The group reports more than 5.8 million members and customers, 12,073 employees and total assets of €211.5 billion.
The bank’s first public statements came on November 4. It said the incident was under control and customer assets were not affected, then issued a question-and-answer statement explaining that the attackers used the bank’s own account and a service provider’s platform. Arkéa explicitly denied that Fortuneo was the entry point and rejected human error on its side, describing the incident as a sophisticated external attack. These are the bank’s statements; investigators have not yet publicly detailed their findings.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data-processing system, according to the source material. France’s anti-cybercrime office is leading the inquiry. Reports about an attack beginning in late October and information circulating online from November 1 have been attributed to Le Figaro and are not confirmed by the bank.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
The Provider and Final Loss Remain Unknown
Arkéa has not named the service provider through which attackers reached the bank, explained how that platform was compromised or disclosed when the intrusion began. The bank says it is working with judicial and police authorities to determine the attack’s origin and method. The provider’s role and any responsibility have not been established publicly.
The amount is also provisional. The bank told Reuters that about €100 million was stolen, but had declined to confirm the earlier €118 million report. It says some funds have been blocked; the amount blocked, the amount ultimately recoverable and the final net loss have not been disclosed. The source material does not establish whether cryptocurrency conversion occurred in this case, only that the bank said the transfers potentially allowed it.
The prosecutor’s investigation is underway, and no findings have been reported in the supplied material. Arkéa says the attack is contained, but further public detail on the security measures affected and the precise timeline is not yet available.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the suspected organised intrusion. The inquiry is expected to establish how access through the service provider led to transfers from Arkéa’s account, who was responsible and where the funds went. No timetable for findings or public updates has been provided.
Arkéa has said it is cooperating with authorities and relevant supervisory bodies, including the European Central Bank and French banking supervisors, according to its November 5 account to Reuters. Further statements may clarify the final amount, how much money has been blocked or recovered, and what changes the bank or provider will make. Until those details are public, the estimated loss and recovery remain provisional.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
Arkéa told Reuters on November 5 that around €100 million was stolen. It has not confirmed a final figure and previously declined to confirm a reported €118 million estimate.
Were customer accounts or deposits affected?
The bank says attackers used Arkéa’s own account, not customer accounts, and that customer deposits were not affected. Those assurances come from the bank’s statements.
How did attackers reach the bank?
Arkéa says they came through the platform of one of its service providers. The bank has not named the provider or explained the technical method. It says Fortuneo was not the entry point.
Can the stolen money be recovered?
The bank says part of the money has been blocked, but it has not said how much or how much can be returned. Recovery prospects and the final loss are not yet clear.
What should Arkéa customers do?
Customers should be alert to messages or calls that use the incident to request credentials or verification codes. Arkéa has warned about phishing; do not disclose a password or SMS code in response to unsolicited contact.
Source: ThorstenMeyerAI.com
