TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said attackers used the bank’s own account to make fraudulent transfers through a service provider’s platform. On 5 November, the bank told Reuters that around €100 million was stolen; some funds have been blocked, but the final loss and recovery are unknown. The Paris prosecutor’s cybercrime section opened an investigation on 4 November.
French cooperative bank Crédit Mutuel Arkéa said on 4 November that attackers used the bank’s own account to carry out fraudulent transfers through a service provider’s platform. The bank told Reuters the following day that around €100 million was stolen; it said some funds had been blocked, while the final loss remained unknown.
The bank said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It said customer accounts were not used and customer deposits were not affected. The bank has not publicly identified the service provider whose platform it says was used.
On the morning of 4 November, Arkéa said it notified relevant supervisory bodies, suspended some transactions as a precaution and filed a complaint with the Paris prosecutor. Its app was unavailable for several hours, according to franceinfo. The bank said almost all operations resumed that morning. In a release that afternoon, it described the incident as “closed and under control.”
Arkéa gave Reuters an estimate of around €100 million stolen on 5 November. Earlier reports cited a figure of $133 million, or about €118 million, but the bank had declined to confirm that amount, saying it could validate only the order of magnitude. Some money has been blocked; neither the total ultimately lost nor the amount recovered has been established publicly.
Crédit Mutuel Arkéa cyberattack What is known so far
Attackers used the bank’s own account to make fraudulent transfers through a service provider’s platform. Customer accounts and deposits were not affected, the bank said.
How the transfers happened
The bank says the attackers used a provider platform to move funds from Arkéa’s own account.
Arkéa says the attackers reached its operations through a service provider’s platform.
Money was sent from the bank’s own account to other banking players.
The amount ultimately lost or recovered has not been established publicly.
What customers should know
- Customer accounts were not used.
- Customer deposits were not affected.
- Verify unusual payment or account requests through trusted channels.
- Do not share passwords or one-time codes in response to messages about the attack.
Investigation and open questions
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating.
Service provider
Arkéa has not named the provider or explained how its platform enabled the transfers.
Attack start
A report that the provider was attacked in late October has not been confirmed by the bank.
Final loss and recovery
Some funds were blocked, but the final loss and recoverable amount remain unknown.
A Bank’s Own Account Was Targeted
The incident draws attention to payments made from a bank’s own accounts, as well as customer-facing systems. Arkéa says the attackers reached its operations through a provider platform, showing why access held by outside suppliers can matter to a bank’s payment controls.
The case also has implications for customers, even though Arkéa says their accounts and deposits were unaffected. The bank warned of possible phishing attempts using the incident. Customers should treat unexpected requests for passwords or one-time codes with caution; the source material says a bank will not ask customers to provide those credentials.
Arkéa is a sizeable group based near Brest, Brittany. It reports more than 5.8 million members and customers, 12,073 employees and €211.5 billion in total assets. Those figures describe the group’s scale, but the bank says the stolen funds came from its own account, not from customer accounts.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
As an affiliate, we earn on qualifying purchases.
The Disclosed Timeline So Far
The bank has not said when the attack began. Le Figaro reported that it started at a service provider that had itself been attacked in late October, and that information about the incident began circulating on X from 1 November. These details are media reports, not confirmed by the bank.
By the morning of 4 November, crypto news outlets and Le Télégramme were reporting a figure of $133 million, or €118 million, and identifying Arkéa as the suspected victim. At 10:29 that day, franceinfo reported a loss of more than €100 million, citing a source close to the case. Arkéa issued its first public statement at 13:00 and a question-and-answer release at 17:30, according to the source material.
The Paris prosecutor’s office confirmed to AFP that it opened an investigation on the morning of 4 November. The prosecutor’s cybercrime section is handling the case, with France’s anti-cybercrime office leading investigative work. On 5 November, Arkéa told Reuters it had informed the European Central Bank, French banking supervisors and prosecutors.
“The attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players”.”
— Crédit Mutuel Arkéa
Provider and Recovery Remain Unknown
Arkéa has not named the service provider or explained in detail how its platform enabled the transfers. The bank also has not said when the attack began. Le Figaro’s account of a provider attack in late October remains unconfirmed by Arkéa.
The reported loss is an estimate, not a final accounting. Some funds have been blocked, but the source material does not state how much, where the funds are, or whether they can be returned. It also gives no further details on the attackers, the specific transactions or the full impact on the bank’s systems.
The bank says customer deposits were unaffected and that the incident was under control. The scope of the ongoing investigation and any further findings have not been reported in the available material.
Investigation and Fund Recovery
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating. Their work may establish how the provider platform was accessed, who carried out the transfers and whether additional funds can be blocked or recovered. No public timetable for findings is given in the source material.
Arkéa may provide a final loss figure as it accounts for the blocked funds and any recovery. For customers and businesses, the immediate practical step is to verify unusual payment or account requests through trusted channels and avoid sharing passwords or SMS codes in response to messages referring to the attack.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts affected?
The bank said customer accounts were not used in the fraudulent transfers and customer deposits were unaffected.
How much money was stolen?
Arkéa told Reuters on 5 November that around €100 million was stolen. Some funds were blocked, but the final loss is not known.
How did the attackers access the bank?
The bank said the attackers came through a service provider’s platform. It has not named the provider or described the access method in detail.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened a case on 4 November, with France’s anti-cybercrime office leading investigative work.
Source: Thorsten Meyer AI
