🔍 Read the full analysis: Inside The Timeline Of Arkéa’s €100 Million Account Hack on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says the attack came through a service provider, not its Fortuneo online bank, and that customer accounts and deposits were unaffected. Investigators have not publicly identified the provider or established the full amount recovered.
French cooperative bank Crédit Mutuel Arkéa said about €100 million was stolen in fraudulent transactions from the bank’s own account, not from customer accounts. The bank said on November 4 that attackers reached it through a service provider’s platform; on November 5, it gave Reuters the approximate loss figure. The incident has prompted a criminal investigation, while the bank says customer deposits were not affected.
In a question-and-answer statement issued on November 4, Arkéa said attackers used the bank’s own account to make transfers to other financial institutions. Those transactions may then have enabled the money to be converted into cryptocurrency through specialised platforms, the bank said. It stated that the attackers did not use accounts held by customers of its federations or subsidiaries.
The bank said the route into its systems was a platform operated by one of its service providers. It has not publicly named the provider. Arkéa said its online bank Fortuneo was not the entry point and described the incident as an external, sophisticated attack rather than human error on its part. It said its security systems detected suspicious activity quickly and that it was working with police and judicial authorities.
Arkéa initially declined to confirm a reported figure of $133 million, or about €118 million, saying it could validate only the order of magnitude. The following day, it told Reuters that around €100 million had been stolen. The bank has said part of the money was blocked, but the available statements do not establish how much has been recovered or the final net loss.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Exposed
The incident differs from fraud in which criminals steal credentials or trick individual customers into sending money. Arkéa says the funds came from its own account, and that the transfers moved through other banking institutions. That makes the case relevant to financial firms’ controls over treasury accounts and payment instructions, as well as to the security of outside providers with access to financial systems.
The reported loss is large, but its precise financial effect remains unsettled. Some funds were blocked, according to the source material, and the bank has not published a complete recovery figure. It is also not yet clear how the attack was carried out through the provider’s platform or which controls failed. The investigation may clarify whether the exposure was limited to one provider or points to wider weaknesses in payment operations.
For customers, Arkéa’s statements distinguish the bank’s own loss from their deposits: it said customer accounts were not used and that customer assets were unaffected. Still, a publicized incident can be used in impersonation attempts. Customers should treat unsolicited requests for passwords, one-time codes or transfers as suspicious, and contact the bank through its official channels.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Samsung QN65LS03FAFXZA 65 The Frame QLED 4K Art Mode Vision AI Smart TV (2025)
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
Arkéa said it detected the attack on November 4 and notified the relevant supervisory and competent bodies. It suspended some transactions as a precaution. The bank’s app was unavailable for several hours that day, according to Franceinfo, while the bank said almost all operations resumed during the morning. Its initial public statement later described the incident as contained and under control.
In a more detailed statement issued that afternoon, the bank explained that the transfers came from its own account and that a service provider’s platform was involved. The Paris prosecutor’s office confirmed that a case had been opened on the morning of November 4. The prosecutor’s cybercrime section is handling the matter, with France’s anti-cybercrime office leading the investigation, according to the source material.
Arkéa is a large banking group based near Brest, in Brittany, and includes Fortuneo among its subsidiaries. The incident therefore involves a bank’s internal funds and operational infrastructure rather than an announced breach of customer accounts. Early reports cited a higher dollar-denominated estimate; the bank did not confirm that number and later supplied its own approximate figure to Reuters.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued November 4
The Provider and Recovery Remain Unknown
Several central details have not been made public. Arkéa has not identified the service provider, described the specific vulnerability or access method, or said when the attack began. The bank’s public account says its own security systems detected suspicious activity quickly, but no independent investigation findings are available in the source material.
The exact loss and amount recovered also remain unresolved. The bank told Reuters that around €100 million was stolen and said part of the money had been blocked; it has not given a final accounting of blocked, recovered or unrecoverable funds. Reports that placed the loss at about €118 million were not confirmed by the bank.
The authorities have opened an investigation, but no suspect, charges or conclusions have been announced in the material provided. The bank’s statements that customer accounts were not used and deposits were unaffected are its account of the incident; further details from investigators have not been published.
Investigators Trace the Transfer Route
The Paris prosecutor’s cybercrime section has opened a case concerning an organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation. Investigators are expected to examine how the provider’s platform was used, how the transfers were authorised and whether the money can be traced or returned.
Arkéa has said it is cooperating with police and judicial authorities and has informed European and French banking supervisors. The next concrete updates will be a clearer account of the final loss and funds recovered, any identification of the service provider, and information from prosecutors about the investigation’s findings. Until then, the bank’s approximate €100 million figure remains the latest public estimate.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on November 5 that around €100 million was stolen. It had declined to confirm an earlier reported estimate of about €118 million and has not published a final loss figure.
Were customer accounts or deposits affected?
Arkéa said the transfers came from its own account, not customer accounts, and said customer assets were unaffected. The source material does not report a separate customer-account breach.
How did the attackers reach the bank?
Arkéa said the attackers came through a platform belonging to one of its service providers. The provider and the precise technical route have not been disclosed.
Was Fortuneo involved as the entry point?
The bank said Fortuneo was not the entry point. It said attackers reached Crédit Mutuel Arkéa through a service provider’s platform.
Has the money been recovered?
The bank said part of the money was blocked, but it has not stated how much was recovered or what the final net loss will be.
Source: ThorstenMeyerAI.com
