🔍 Read the full analysis: Crédit Mutuel Arkéa Reports €100 Million Theft on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said about €100 million was stolen through fraudulent transactions from the bank’s own account, not from customer accounts. The bank says attackers accessed it through a service provider and that some funds have been blocked; the final loss and recovery prospects are not known.
On **November 4**, the bank said it had been the victim of an attack that enabled fraudulent operations. In a more detailed statement later that day, it said attackers used a Crédit Mutuel Arkéa account to send transactions to other banking institutions. The bank said the transactions could have allowed the money to be converted into cryptocurrency through specialist platforms, but did not confirm that all or any of the stolen funds were converted.
The bank told **Reuters on November 5** that around **€100 million** had been stolen. It had not confirmed an earlier reported figure of $133 million, or about €118 million, saying it could validate only the order of magnitude. Crédit Mutuel Arkéa said **part of the funds had been blocked**. It has not provided a final loss figure or said how much may be recovered.
The bank said the attackers entered through the platform of **one of its service providers**, which it has not identified. It ruled out Fortuneo, its online banking subsidiary, as the entry point and said the incident was not caused by human error on its side. The bank said it detected suspicious activity quickly, contained the attack and reported it to relevant authorities and supervisors.
The documented timeline is incomplete because the bank has not said when the attack began. It said it informed competent and supervisory bodies and suspended some transactions as a precaution after detecting the incident on **November 4**. Franceinfo reported that the banking app was unavailable for several hours and that almost all operations resumed that morning. At 1 p.m., the bank said the incident was contained and under control. Its later question-and-answer statement explained the bank-account and supplier details. The Paris prosecutor’s office confirmed that an investigation had opened that morning.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The reported theft stands apart from fraud that targets individual customers: according to the bank, the funds came from a **bank account used for its own transactions**, not from customers’ current accounts or deposits. That distinction matters to customers concerned about their balances, but the bank’s assurance does not establish that every operational or service effect has been fully assessed.
The stated route also points to a broader security issue for financial institutions: a supplier’s platform can provide a pathway into a bank’s own systems or payment processes. The bank has not explained what access the provider had, how the attackers used it or whether other organizations face related exposure. Those details will matter to understanding how the attack was possible and what controls could prevent a similar incident.
For customers, the immediate concern may be **fraudulent messages exploiting the incident**. The bank urged customers to be alert to phishing. Customers should treat requests for passwords or one-time SMS codes as suspicious; this is a general security precaution, not a claim that customer accounts were breached in this incident.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
As an affiliate, we earn on qualifying purchases.
How the November 4 Disclosure Unfolded
Crédit Mutuel Arkéa is a cooperative banking group based near Brest in Brittany. It includes the Crédit Mutuel federations of Brittany and the South-West, around 40 subsidiaries and online bank Fortuneo. The group reports **more than 5.8 million members and customers** and **€211.5 billion in total assets**. Those figures describe the wider group, not the amount affected by the attack.
The first public disclosures did not establish the amount or the route into the bank. On November 4, news outlets reported a possible theft of $133 million, or approximately €118 million. The bank’s statements that day confirmed an attack but initially declined to verify that figure. Its later account identified the bank’s own account and a service-provider platform as the route, while the following day it told Reuters the stolen amount was around €100 million.
Some earlier timing details remain **media reports rather than bank-confirmed facts**. Le Figaro reported that the attack began at a service provider hit in late October and that information circulated on social media from November 1. The bank has not confirmed those dates. The Paris prosecutor’s cybercrime section opened a case on November 4 concerning organised intrusion into a data processing system, with France’s anti-cybercrime office leading the investigation, according to the supplied reporting.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued November 4
What Investigators Have Yet to Establish
The bank has not disclosed the attack’s **start time, technical method or full sequence of events**. It has not named the service provider or explained what systems or permissions were involved. The provider’s role, and whether any of its other customers were exposed, remain unclear.
The precise amount lost is also unsettled. The bank told Reuters that around €100 million was stolen and said some funds were blocked, but it has not published a final figure, the amount recovered or the amount still missing. Its statement that transactions could potentially have enabled conversion into cryptocurrency does not confirm that conversion occurred.
The bank says customer accounts were not used and customer deposits are unaffected. The available statements do not detail the full scope of any service disruption or provide technical findings from the investigation. Those may emerge as the bank and authorities establish the attack’s origin and method.
Investigation and Fund Recovery
The investigation opened by the Paris prosecutor’s cybercrime section is expected to examine the intrusion, the transactions and the service provider’s platform. The bank says it is working with judicial and police authorities to establish the **origin and method of the attack**. No timetable for findings has been announced in the supplied material.
Crédit Mutuel Arkéa may provide further information on the final amount, funds blocked or recovered, and any operational impact as its review proceeds. For now, the bank has advised customers to watch for phishing messages linked to the incident. Readers should rely on official bank communications rather than unsolicited messages claiming to offer help or requesting credentials.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts used?
The bank says attackers used **Crédit Mutuel Arkéa’s own account**, not accounts belonging to customers of its federations or subsidiaries. It says customer deposits are unaffected.
How much money was stolen?
The bank told Reuters on **November 5** that around **€100 million** was stolen. It said some funds had been blocked, but has not published a final loss or recovery figure.
How did attackers access the bank?
Crédit Mutuel Arkéa says attackers came through the platform of **one of its service providers**. The bank has not named the provider or disclosed the technical method.
Was Fortuneo involved as the entry point?
The bank said attackers did **not** enter through Fortuneo, its online banking subsidiary. It said they accessed Crédit Mutuel Arkéa through a service provider instead.
What should customers do now?
The bank has warned customers about phishing. Treat unsolicited requests for passwords or SMS verification codes as suspicious, and check messages through the bank’s official channels.
Source: ThorstenMeyerAI.com
