🔍 Read the full analysis: Arkéa’s €100 Million Hack Raises Questions About Its Own Account on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said attackers used the bank’s own account to make fraudulent transfers, and told Reuters on November 5 that about €100 million was stolen. The bank says customer accounts and deposits were not affected, part of the money has been blocked, and investigators are examining how attackers accessed a service provider’s platform.
French cooperative bank Crédit Mutuel Arkéa said attackers used its own account to make fraudulent transfers, with the bank telling Reuters on November 5 that about €100 million was stolen. Arkéa says the activity came through a service provider, not customer accounts, and that customer deposits were not affected; investigators are still working to establish how the attack was carried out.
In a question-and-answer statement issued on November 4, Arkéa said the attackers used the bank’s own account to send transactions to other banking institutions. The bank said those transfers may have enabled the money to be converted into cryptocurrency through specialised platforms. It said the attackers did not use accounts belonging to customers of its federations or subsidiaries.
On November 5, Arkéa told Reuters that around €100 million had been stolen. The bank had previously declined to confirm a reported figure of $133 million, or about €118 million, saying it would only validate the order of magnitude. Arkéa said some of the money had been blocked, but the final amount lost and the amount recovered remain unknown.
The bank said the route into its systems involved a service provider’s platform, which gave attackers access to Arkéa directly. It said Fortuneo, its online banking subsidiary, was not the entry point, and described the incident as an external attack rather than human error on its side. Arkéa said it detected suspicious activity, suspended some transactions as a precaution and notified relevant authorities. Its statements described the incident as contained; the Paris prosecutor’s office opened an investigation on the morning of November 4.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why a Bank’s Own Account Was Targeted
The disclosed route makes the incident different from familiar cases involving stolen card details or fraud against individual customers. The money, according to Arkéa, came from the bank’s own account. The case draws attention to how payment authority and access held by outside suppliers can expose a financial institution to fraud, even when customer accounts are not directly involved.
For businesses, the reported method highlights a risk that extends beyond a company’s internal systems: a supplier platform that can initiate or facilitate payments may also become a route into financial operations. The public information does not establish which controls failed, or whether the provider itself was compromised, so the precise security lesson will depend on the investigation.
For customers, Arkéa says their accounts and deposits were not affected. That distinction matters, but it does not remove the risk of follow-on impersonation attempts. The bank has warned customers about phishing; people should treat unsolicited messages about the incident with caution and never share passwords or one-time security codes in response to a call, text or email.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
As an affiliate, we earn on qualifying purchases.
How Arkéa Disclosed the Incident
Arkéa announced on November 4 that it had been “the victim of an attack that enabled fraudulent operations.” Its first public statement said the incident was under control, customer assets were unaffected and customers should be alert to phishing. A later statement that day provided more detail about the bank’s own account, the service provider and the role of Fortuneo.
The bank said it informed competent and supervisory bodies after detecting the attack and suspended some transactions as a precaution. Reports said some banking services were briefly unavailable, with most operations resuming during the morning. Those service details were reported by French media; Arkéa’s public statements did not provide a full technical timeline or say when the intrusion began.
The Paris prosecutor’s cybercrime section opened a case on November 4 for suspected organised intrusion into a data-processing system. France’s anti-cybercrime office is leading the investigation, according to the source material. Arkéa, headquartered near Brest, includes the Brittany and South-West federations of Crédit Mutuel and around 40 subsidiaries, including Fortuneo.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, November 4 statement, translated from French
The Loss and Attack Route Remain Unsettled
The final financial loss is not yet known. Arkéa told Reuters that around €100 million was stolen and said some funds had been blocked, but it has not disclosed how much may be recovered or whether any money has been returned. Its earlier response to the larger reported figure was that it could validate only the order of magnitude.
The bank has not identified the service provider or explained what access its platform had, how the attackers obtained or used that access, or when the activity began. The precise sequence of transfers and the possible conversion of funds into cryptocurrency have not been fully documented publicly. Those details remain subject to the police investigation.
Arkéa says customer accounts were not used and customer deposits were unaffected. No public information in the supplied material indicates that this finding has been disputed, but technical findings and a full account of the incident have not yet been released.
Investigators Trace Transfers and Access
The Paris prosecutor’s investigation is expected to establish how the attackers reached Arkéa through a service provider and trace the transactions made from the bank’s account. Authorities and the bank will also need to determine what funds can be recovered. No public timetable for the investigation or a fuller technical report has been given.
Arkéa says it is working with judicial and police authorities to identify the origin and method of the attack. The bank has also said it notified European and French banking authorities. Further public updates may clarify the total loss, the blocked funds and the provider’s role, but those details have not yet been confirmed.
Customers should follow notices from the bank through its established channels and be alert to messages that use the incident to request credentials or payments. Businesses may review which outside platforms can initiate or approve transfers, while avoiding assumptions about the specific weaknesses in Arkéa’s systems until investigators publish their findings.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts raided?
Arkéa says no. The bank says attackers used its own account for the transactions and did not go through customer accounts. It also says customer deposits were not affected.
How much money was stolen?
Arkéa told Reuters on November 5 that around €100 million was stolen. Some funds have been blocked, but the final loss and the amount that may be recovered are not yet known.
How did the attackers get in?
The bank says the attackers came through a service provider’s platform. It has not named the provider or publicly explained the technical method. Arkéa says Fortuneo was not the entry point.
Is the investigation under way?
Yes. The Paris prosecutor’s cybercrime section opened an investigation on November 4, led by France’s anti-cybercrime office. The case concerns suspected organised intrusion into a data-processing system.
What should customers do about possible scam messages?
Be cautious with unsolicited calls, texts and emails about the incident. Do not provide a password or one-time code in response to a message or call; use the bank’s official channels to check any request.
Source: ThorstenMeyerAI.com
