TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said about €100 million was transferred fraudulently from the bank’s own account after attackers gained access through a service provider’s platform. The bank says customer accounts were not involved and deposits are unaffected; the provider’s identity and the amount recovered remain unknown.
Crédit Mutuel Arkéa said around €100 million was transferred fraudulently from the French bank’s own account after attackers accessed its systems through a service provider’s platform. The bank said customer accounts were not used and deposits are unaffected; prosecutors have opened an investigation.
In a statement on November 4, the bank said it had been “the victim of an attack that enabled fraudulent operations.” It later explained that the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” On November 5, the bank told Reuters that about €100 million had been transferred.
Earlier reports cited a figure of $133 million, or about €118 million. The bank did not confirm that amount, saying it could “validate the order of magnitude.” It has said that some funds have been blocked, but has not provided a final accounting of the amount recovered. The $133 million figure should therefore be treated as an earlier report, not the bank’s confirmed estimate.
The bank said the intrusion came “through the platform of one of our service providers” and did not name the provider. It denied that its online bank, Fortuneo, was the entry point and ruled out human error on its side. After detecting the attack, the bank said it notified competent and supervisory bodies and suspended some transactions as a precaution. Almost all operations resumed during the morning of November 4, according to its account.
Crédit Mutuel Arkéa fraudulent transfers
Attackers used the bank’s own account after accessing systems through an unnamed service provider’s platform. The bank says customer accounts and deposits were unaffected.
What the bank says
The transfers came from the bank’s account, not customer accounts.
- Crédit Mutuel Arkéa’s own account
- Access through a service provider platform
- Customer accounts were not used
- Customer deposits were unaffected
What remains unclear
The bank and investigators have not established key details publicly.
- The service provider’s identity and the technical method
- How attackers gained authority to make transfers
- How much money was blocked or recovered
- When the intrusion began
Investigation and next steps
The Paris prosecutor’s cybercrime section opened an investigation, led by France’s anti-cybercrime office, according to the source material.
Investigators will examine the provider platform and the transfer permissions involved.
Further updates may clarify blocked funds, recovery and the final loss.
Use the bank’s official channels. Treat unsolicited messages with care; the bank says it will not ask for passwords or SMS codes by message or phone.
Transfers Came From the Bank’s Own Account
The incident involved funds held in the bank’s own account, rather than customer accounts. Crédit Mutuel Arkéa said attackers gained access through a supplier platform. The bank has not publicly detailed how the transfers were initiated or which controls failed.
The incident raises questions about the access and payment permissions banks grant to outside providers. A supplier platform connected to systems that move money can create risks for the organizations it serves. The bank says customer deposits were unaffected. Customers should be alert to messages that impersonate the bank and use the incident to solicit account information.
Security specialists have commented on the reported scale of the incident. A security firm head told Reuters the attack was unprecedented in Europe. A French security adviser quoted by Le Monde described it as an attack of unprecedented scale and damage. These are attributed assessments; a public investigation report has not established those characterizations.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, 12MP Center Stage Camera, Touch ID, Wi-Fi 7, Midnight
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
The bank has not stated when the attack began. Le Figaro reported that the service provider was attacked in late October and that information about the incident began circulating on X from November 1. Those timeline details are media reports and have not been confirmed by the bank.
On the morning of November 4, crypto news outlets reported a suspected theft of about $133 million and identified Crédit Mutuel Arkéa as the possible victim, Reuters later noted. That day, the bank said it had detected an attack, suspended some transactions, and filed a complaint with the Paris prosecutor. Its app was unavailable for several hours, franceinfo reported, while almost all operations resumed during the morning, according to the bank.
The bank’s first public statement on November 4 said the incident was “closed and under control,” that customer assets were unaffected, and that customers should watch for phishing. A later question-and-answer statement described the bank’s own account, the supplier platform, and Fortuneo. The Paris prosecutor’s office confirmed to AFP that it had opened an investigation that morning. On November 5, the bank gave Reuters its estimate of around €100 million stolen.
““the victim of an attack that enabled fraudulent operations””
— Crédit Mutuel Arkéa
Key Details Still Unconfirmed
The bank has not named the service provider or described the technical method used to gain access, how attackers obtained authority to initiate the transfers, or when the intrusion began. Those details may emerge through the investigation, but they are not established in the statements cited so far.
The exact amount that can be recovered is also unknown. The bank told Reuters that about €100 million was stolen and said some funds were blocked, without specifying the blocked amount or how much has been returned. Earlier reports of $133 million, or approximately €118 million, have not been confirmed by the bank.
The case remains under investigation. The bank has said customer accounts were not used and customer deposits were unaffected. The available material does not include a final independent account of the incident or a detailed public report on its effects.
Investigation and Recovery Update
The Paris prosecutor’s cybercrime section opened a case on the morning of November 4 into organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation, according to the source material. Prosecutors and investigators will need to establish how the provider platform was compromised, who initiated the transfers, and where the money went.
Further updates from the bank may clarify how much of the transferred money was blocked or recovered, the final loss, and what changes it will make to supplier access and payment controls. Customers should rely on the bank’s official channels for account information and treat unsolicited messages about the incident with care. The bank has warned customers about phishing; it will not ask for a password or SMS verification code by message or phone.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank said attackers used its own account to make transfers and that customer accounts were not used. It said customer deposits were unaffected.
How much money was stolen?
On November 5, the bank told Reuters that around €100 million had been stolen. It has not confirmed an earlier reported figure of $133 million, or about €118 million.
Has any of the money been recovered?
The bank said some funds had been blocked, but it has not disclosed how much or given a final recovery figure.
How did the attackers get access?
The bank said access came through the platform of an unnamed service provider. It has not publicly described the technical method or named the provider.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened an investigation on November 4. France’s anti-cybercrime office is leading it, according to the source material.
Source: Thorsten Meyer AI
