🔍 Read the full analysis: Crédit Mutuel Arkéa Hack: How The Money Left on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said attackers used a service provider’s platform to conduct fraudulent transactions from the bank’s own account, not from customer accounts. On Nov. 5, the bank told Reuters that around €100 million was stolen; some funds have been blocked, but the final amount and recovery prospects remain unclear.
Crédit Mutuel Arkéa said on Nov. 4 that attackers used a service provider’s platform to make fraudulent transactions from the bank’s own account, and on Nov. 5 told Reuters that around €100 million was stolen. The bank says customer accounts were not used and customer deposits are not affected; French prosecutors have opened an investigation.
In a question-and-answer statement issued on Nov. 4, the bank said the attackers used its account to send money to other banking institutions. It said those transfers may have allowed the funds to be converted into cryptocurrency through specialist platforms. The bank’s account, rather than accounts belonging to customers of its federations or subsidiaries, was the source of the transactions, according to the statement.
The bank said the attackers gained access through a platform operated by one of its service providers. It has not named the provider or disclosed the technical details of the access. Arkéa said its online bank Fortuneo was not the entry point and described the incident as an external attack, rejecting human error on its side.
Arkéa told Reuters on Nov. 5 that the amount stolen was around €100 million. The bank had previously declined to confirm reports of $133 million, or about €118 million, saying it would validate only the order of magnitude. It says some money has been blocked, but has not given a final accounting of the loss or the amount recovered.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from familiar cases in which criminals steal card details or access individual customers’ accounts. Here, according to Arkéa, the transactions came from the bank’s own account. That makes the episode relevant to banks and other organizations that allow suppliers to connect to systems involved in payments: a third party’s platform can form part of an organization’s financial attack surface.
For customers, the bank says deposits and customer accounts were not affected. That does not remove the risk of follow-on scams. Arkéa warned customers about phishing, and a widely publicized breach can give criminals a reason to send messages pretending to be the bank. Customers should treat requests for passwords or one-time SMS codes as suspicious and contact the bank through its usual channels rather than links in unexpected messages.
The reported sum is large, but its ultimate effect on Arkéa’s finances and the amount that can be recovered are not yet established. The bank has said funds were blocked in part; that is not the same as confirming that the money has been returned.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Apple MacBook Air 13.6-inch with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
As an affiliate, we earn on qualifying purchases.
From Detection to Public Disclosure
The bank has not said when the intrusion began. A timeline published in the source account includes reports that the attack may have started at a service provider in late October and that information circulated online from Nov. 1. Those details were attributed to Le Figaro and have not been confirmed by Arkéa, so they should be treated as reported rather than established facts.
Arkéa said that after detecting the attack on the morning of Nov. 4, it notified relevant authorities and supervisors and suspended some transactions as a precaution. Its banking app was unavailable for several hours that morning, according to franceinfo. The bank said almost all operations resumed during the morning and described the incident as contained and under control in a statement issued at 1 p.m.
In a more detailed statement later that day, Arkéa explained that its own account had been used and identified a service provider’s platform as the route in. The Paris prosecutor’s cybercrime section opened an investigation that morning into suspected organised intrusion into a data-processing system, according to reports of the prosecutor’s confirmation to AFP. France’s anti-cybercrime office is leading the case. On Nov. 5, Arkéa told Reuters the amount was around €100 million and said it had informed European and French banking authorities as well as prosecutors.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 question-and-answer statement
The Amount and Recovery Remain Open
The investigation has not publicly established when the attack began, exactly how the supplier platform was compromised, or which provider was involved. Arkéa says its security systems detected suspicious activity quickly, but it has not released technical evidence or a detailed account of the attackers’ actions.
The precise loss is also unsettled. The bank’s estimate of around €100 million, given to Reuters on Nov. 5, is not a final audited figure. The earlier €118 million report was not confirmed by the bank. It is also unclear how much of the money has been blocked, whether any blocked funds will be returned, and how much may have been converted into cryptocurrency.
Prosecutors have opened a case, but no suspects, charges, or findings have been reported in the supplied material. The bank’s statements that customer accounts were not used and deposits were unaffected are its account of the incident; independent investigative findings have not yet been made public.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the intrusion and the movement of funds. Further updates may establish the supplier involved, the method used to gain access, and whether the money can be recovered. Arkéa has said it is working with judicial and police authorities to determine the origin and method of the attack.
For now, the clearest next milestones are a more complete accounting from the bank and any findings announced by investigators or banking supervisors. Customers should follow notices through Arkéa’s official channels and remain alert to messages using the incident to solicit credentials or verification codes. Businesses can review which supplier platforms can initiate or support payments, while treating the specific responsibility for this breach as unresolved.
Key Questions
Was money taken from Crédit Mutuel Arkéa customers?
The bank says no. It says the attackers used the bank’s own account and did not transact through customer accounts. Arkéa also says customer deposits are not affected.
How much money was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. The bank has not published a final figure, and it previously declined to confirm a reported €118 million amount.
How did the attackers get in?
Arkéa says the attackers came through a platform belonging to one of its service providers. The bank has not named the provider or explained the technical route. It says Fortuneo was not the entry point.
Can the stolen money be recovered?
Arkéa says some funds have been blocked, but it has not said how much or confirmed that the money has been returned. The recovery outlook remains unclear while investigators trace the transfers.
What should customers do now?
Be alert to phishing messages that use the incident as a pretext. Do not share passwords or SMS verification codes in response to a message or call; contact the bank through its established website, app, or phone channel if a request seems suspicious.
Source: ThorstenMeyerAI.com
