🔍 Read the full analysis: How The Arkéa Bank Hack Unfolded Around A €100 Million Loss on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that around €100 million was stolen through fraudulent transactions from the bank’s own account, using a platform operated by an unnamed service provider. The bank says customer accounts and deposits were not affected; the amount recovered, the precise method and the supplier’s identity remain unclear.
Crédit Mutuel Arkéa said on Nov. 5 that around €100 million was stolen in a cyberattack that used a service provider’s platform to make fraudulent transfers from the bank’s own account. The French cooperative banking group says customer accounts were not used and customer deposits are not affected; investigators have not yet established publicly how the attackers gained access or how much money can be recovered.
The bank first disclosed the attack on Nov. 4, saying attackers had carried out fraudulent operations. In a more detailed statement later that day, it said they used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions. The money did not come from accounts held by customers of the group’s federations or subsidiaries, according to the bank.
On Nov. 5, Arkéa told Reuters that around €100 million had been stolen. The bank had earlier been asked about reports of $133 million, or approximately €118 million, and declined to confirm that figure, saying it could only validate the order of magnitude. Arkéa says part of the money has been blocked, but the final loss and amount recovered are not yet known.
Arkéa said the attackers reached it through the platform of one of its service providers, which it has not named. It said Fortuneo, its online banking subsidiary, was not the entry point and described the attack as external and sophisticated. The bank also said its security systems detected suspicious activity quickly. Those are the bank’s statements; the investigation has not yet publicly set out a full technical account.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The reported loss highlights a risk beyond the theft of individual customer credentials: an institution’s own payment and treasury operations can be targeted. Arkéa says the fraudulent transfers were made from its account, meaning the incident differs from scams in which criminals take money directly from customers’ accounts. The distinction matters for customers, but it does not make the event minor: the amount reported is substantial and the bank says some funds remain blocked while recovery is assessed.
The role attributed to a supplier also points to the potential exposure created when external platforms can connect to financial institutions or initiate transactions. Arkéa has not disclosed the provider or the specific weakness used, so the incident does not establish that a particular technology or supplier practice caused the breach. Still, it puts third-party access, payment controls and monitoring at the center of questions facing banks and other organizations that rely on outside services.
For customers, Arkéa’s account is that their accounts and deposits were not affected. The bank warned customers to be alert to phishing, a relevant precaution after a high-profile incident: criminals may exploit news of a breach to pose as bank staff. The bank says customers should not share passwords or one-time SMS codes in response to unexpected requests.
Products Worth Considering
EcoFlow Delta 3 Portable Power Station – 1024 Wh, 1800 W
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
As an affiliate, we earn on qualifying purchases.
How the Disclosure Developed
The bank has not said when the attack began. Some timing details remain media reports rather than bank-confirmed facts. Le Figaro reportedly placed the start at a supplier affected in late October and said information about the incident circulated on social media from Nov. 1. The bank has not confirmed those dates, and they should not be treated as an established timeline.
On the morning of Nov. 4, Arkéa said it notified the relevant authorities and supervisory bodies after detecting the activity, and suspended some transactions as a precaution. Franceinfo reported that the banking app was unavailable for several hours. The bank said almost all operations resumed that morning and later described the incident as contained. It issued a public statement that afternoon and followed it with a question-and-answer statement giving further details about the account used and the supplier route.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4, according to the prosecutor’s office as reported by AFP. The case was opened for organised intrusion into a data processing system and was assigned to France’s anti-cybercrime office. Arkéa says it filed a complaint and is working with judicial and police authorities. The group, based near Brest, includes the Brittany and South-West federations of Crédit Mutuel and subsidiaries including Fortuneo.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in a statement on Nov. 4
What Investigators Have Yet to Establish
The public record does not yet identify the service provider, the vulnerability or access method used, or when the attackers first entered the systems. The bank says it is working with authorities to establish the origin and modus operandi. Its description of the attack as contained is not the same as a public forensic account of what happened.
The final financial impact is also unresolved. Arkéa has said around €100 million was stolen and that part of the money has been blocked, but it has not stated how much has been recovered or whether all blocked funds will return to the bank. Reports of a higher figure have not been confirmed by the bank. It is also not yet clear whether investigators have identified suspects or whether the supplier platform itself was compromised.
Investigation and Recovery Steps
France’s anti-cybercrime office is leading the investigation opened by the Paris prosecutor’s cybercrime section. Authorities are expected to establish how the supplier platform was used, trace the transfers and determine whether funds can be returned. No public completion date or recovery timetable has been announced.
Arkéa says it has informed the relevant banking supervisors and is working with police and judicial authorities. Further updates may clarify the confirmed loss, the amount recovered, the supplier’s role and whether any customer-facing services were affected beyond the temporary app disruption reported on Nov. 4. Until investigators or the bank provide those details, the precise mechanics and full financial outcome remain open.
Key Questions
Were customer accounts used to take the money?
No, according to Arkéa. The bank says the transfers came from its own account, not from accounts held by its customers, and says customer deposits are not affected.
How much was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. It had declined to confirm an earlier reported figure of about €118 million. The final loss remains unknown because some money has been blocked and the amount recovered has not been disclosed.
How did the attackers get into the bank?
Arkéa says they came through a platform operated by one of its service providers. The bank has not named the provider or publicly explained the technical method used.
Was Fortuneo involved as the entry point?
Arkéa says no. The bank has stated that attackers did not enter through Fortuneo, its online banking subsidiary. The investigation is still examining the attack’s origin and method.
What should customers do now?
The bank says customer deposits are unaffected and has warned of possible phishing linked to the story. Customers should be cautious of unsolicited messages claiming to be from the bank and never share a password or SMS verification code in response to a request.
Source: ThorstenMeyerAI.com
