🔍 Read the full analysis: Arkéa Says About €100 Million Was Stolen on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through fraudulent transfers from the bank’s own account, not customer accounts. The bank says attackers accessed it through a service provider; French authorities opened an investigation, and the amount ultimately recovered is not yet known.
French cooperative banking group Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through fraudulent operations using the bank’s own account, after attackers gained access through a service provider’s platform. The bank says customer accounts were not used and customer deposits are unaffected; prosecutors opened an investigation on November 4.
The bank’s November 4 statements described attackers using Crédit Mutuel Arkéa’s own account to make transactions to other banking institutions. The bank said the activity did not pass through accounts belonging to customers of its federations or subsidiaries. It said the transfers may have allowed the money to be converted into cryptocurrency through specialist platforms, but did not confirm that all the funds took that path.
On November 5, Arkéa told Reuters that around €100 million had been stolen. The bank had previously declined to confirm reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. Arkéa says some funds have been blocked. The final loss and amount recovered remain unknown.
The bank said the attackers reached it through a platform operated by one of its service providers, which it has not identified. It denied that its online bank Fortuneo was the entry point and said the incident was not caused by human error on its side. Arkéa said suspicious activity was detected quickly, some transactions were suspended as a precaution, and almost all operations resumed during the morning of November 4. France’s Paris prosecutor’s cybercrime section opened a case that morning, with the national anti-cybercrime office leading the investigation.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from thefts that directly drain customer accounts: according to Arkéa, the money came from the bank’s own funds. The bank says customer deposits were not affected, but a theft of this reported scale puts the security of banks’ payment operations and treasury accounts under scrutiny.
The stated route also puts attention on third-party access and payment controls. A supplier’s platform can form part of a bank’s operational security boundary if it can help initiate or enable transactions. The investigation may clarify how that access was obtained and what safeguards failed or were bypassed; those details have not yet been made public.
For customers, Arkéa’s statements do not indicate that their accounts were the source of the stolen funds. The bank did warn of possible phishing using the incident as a pretext. Customers should treat requests for passwords or one-time codes as suspicious and contact their bank through its official channels.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Samsung Galaxy Tab A7 Lite 8.7 32GB Wi‑Fi Android Tablet – Long‑Lasting Battery, Compact Slim Design, Sturdy Metal Frame (US Version)
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
The November 4 Response
The available timeline is incomplete because Arkéa has not said when the attack began. Le Figaro reported that the incident began at a service provider in late October and that information circulated on social media from November 1. Those dates are media reporting, not a timeline confirmed by the bank.
By the morning of November 4, reports of a suspected large theft were circulating. Arkéa said it notified relevant authorities and supervisors when the attack was detected and temporarily suspended some transactions. Franceinfo reported that the banking app was unavailable for several hours. The bank said almost all operations resumed that morning.
At about 1 p.m. on November 4, Arkéa issued a statement saying the incident was contained and customer assets were unaffected. A more detailed question-and-answer statement followed at about 5:30 p.m., addressing the bank account, supplier platform, Fortuneo and the reported amount. The prosecutor’s office confirmed that an investigation had been opened that morning. On November 5, Arkéa gave Reuters its estimate of about €100 million stolen.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in a November 4 statement
The Amount and Attack Route
The precise loss is not settled. Arkéa told Reuters the amount was around €100 million, but it had not confirmed the higher €118 million figure reported earlier. The bank said some money had been blocked; it has not stated how much, whether more can be recovered, or what the final net loss will be.
The bank has not named the service provider or described the technical weakness, the transactions’ full path, or when the intrusion began. Its statement that the incident is contained is the bank’s assessment; public details from investigators remain limited. It is also not yet clear whether the possible conversion of funds into cryptocurrency occurred in every transaction.
Investigators Trace the Transfers
The Paris prosecutor’s investigation is examining the alleged intrusion into a data processing system and the events that enabled the transfers. France’s anti-cybercrime office is leading the case. The inquiry is expected to establish how the supplier platform was used, which transactions were made and whether additional funds can be blocked or returned.
Arkéa has said it is cooperating with judicial and police authorities and has informed relevant banking supervisors, including the European Central Bank and French authorities, according to its statement to Reuters. The bank has not provided a public date for a further update. Customers should follow notices from Arkéa and use official contact details if they receive messages about the incident.
Key Questions
Were customer accounts used in the theft?
Arkéa says the attackers used the bank’s own account, not accounts belonging to its customers. It says customer deposits were not affected.
How much money was stolen?
On November 5, Arkéa told Reuters that around €100 million was stolen. The bank had not confirmed an earlier report of about €118 million, and the final loss is still unknown.
How did the attackers get access?
The bank says they came through a platform belonging to one of its service providers. It has not named the provider or released technical details of the intrusion.
Is the money being recovered?
Arkéa says part of the funds has been blocked. It has not disclosed the amount blocked or how much may ultimately be recovered.
What should customers do now?
The bank has warned about possible phishing linked to the incident. Do not share passwords or one-time codes in response to unsolicited messages, and contact the bank using its official channels if concerned.
Source: ThorstenMeyerAI.com
