🔍 Read the full analysis: A Timeline Of What We Know About Arkéa’s €100 Million Hack on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says the attackers reached it through a service provider, not Fortuneo or customer accounts; prosecutors opened an investigation on Nov. 4. The precise loss, the supplier’s identity and how much money can be recovered remain unclear.
Crédit Mutuel Arkéa said on Nov. 5 that attackers stole about €100 million through fraudulent transactions from the French bank’s own account, rather than from customer accounts. The bank said the attackers gained access through a service provider’s platform, and French prosecutors opened an investigation on Nov. 4.
The bank’s more detailed statement, issued on the evening of Nov. 4, said attackers used Crédit Mutuel Arkéa’s own account to send transactions to other banking institutions. It said customers’ accounts at its federations and subsidiaries were not used and that customer deposits were unaffected. The bank also said Fortuneo, its online banking subsidiary, was not the point of entry.
Arkéa said the intrusion came through the platform of one of its service providers, but has not publicly identified the company. It said its security systems detected suspicious activity quickly, that it suspended some transactions as a precaution and that the incident was contained. The bank said it had informed relevant supervisory bodies and filed a complaint.
On Nov. 4, the bank described the incident as under control and said almost all operations had resumed that morning, according to its statement and reporting by French media. Its banking app was unavailable for several hours, franceinfo reported. On Nov. 5, Arkéa gave Reuters an estimate of about €100 million stolen. The bank had previously declined to confirm reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. It said some funds had been blocked; the final loss was not established in the available statements.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Routes Were Targeted
The reported loss matters beyond its size because the bank says the attack used its own account and payment relationships, not a stream of compromised customer accounts. That distinction changes the immediate concern for customers: Arkéa says their deposits and accounts were not affected, while the incident points to risks in a bank’s internal financial operations and the external platforms connected to them.
The case also draws attention to supplier access. A service provider may be an indirect route into a financial institution, even when a bank’s consumer-facing service is not the entry point. The bank has not explained what access the supplier had or how that access was abused, so the public record does not yet show which safeguards failed or how broadly the method could apply.
For customers, the bank’s warning about possible phishing attempts is relevant. News of a major incident can be used to make fake messages seem credible. Arkéa advised customers to be alert, but the information provided does not indicate that customer credentials were stolen in this incident.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
Ninja Flip Toaster Oven & Air Fryer, 8-in-1, Stainless Steel, SP151
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
How the Reports and Statements Unfolded
The timing of the attack itself has not been confirmed by the bank. Le Figaro reported that the incident began at a service provider in late October and that information began circulating on X on Nov. 1. Those details are media reports, not a timeline confirmed by Arkéa.
By the morning of Nov. 4, cryptocurrency news outlets were reporting a loss of about $133 million and naming Arkéa as the suspected victim. At 10:29 a.m., franceinfo reported a loss of more than €100 million, citing a source close to the case. Arkéa’s first public statement that afternoon said the incident was contained and customer assets were unaffected. A second statement that evening explained the use of the bank’s own account and a service provider’s platform.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation, according to the supplied reporting. Arkéa is a banking group based near Brest that includes the online bank Fortuneo; it reports more than 5.8 million members and customers.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued Nov. 4
The Loss and Intrusion Route Remain Open
The bank has not published a final accounting of the money taken. Its estimate of about €100 million differs from earlier reports of roughly €118 million, and Arkéa has said that some funds were blocked. It remains unclear how much can be recovered, how much ultimately represents a loss, and whether the bank will revise its estimate.
The service provider has not been named, and the bank has not disclosed when the intrusion began, what systems or permissions were involved, or precisely how the attackers initiated the transfers. Investigators are working to establish the origin and method. The bank’s description of a sophisticated external attack is its account of the incident, not a published forensic report.
Arkéa says customer accounts were not used and deposits were unaffected. No information in the supplied reporting establishes that customer data or credentials were taken. The investigation may clarify whether any such information was accessed, but that remains unknown.
Investigators Trace Transfers and Access
The Paris prosecutor’s investigation is expected to examine how the attackers used the supplier platform, how the transfers were authorised and where the money went. Arkéa says it is working with judicial and police authorities to establish the origin and method of the attack. Authorities and the bank have not announced a timetable for findings.
The bank may provide a clearer figure as it tracks blocked funds and assesses what can be returned. Until it releases a final accounting or investigators publish further details, the total recoverable amount and the supplier’s role remain unresolved. Customers should rely on official bank communications and be wary of messages asking for passwords or SMS verification codes.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank says attackers used Arkéa’s own account, not customer accounts, and that customer deposits were unaffected. The available statements do not establish that customer data or credentials were stolen.
How much money was taken?
Arkéa told Reuters on Nov. 5 that about €100 million was stolen. Earlier reports put the amount at about €118 million, but the bank had not confirmed that figure. It said some funds were blocked, and the final loss is not yet known.
How did the attackers reach the bank?
Arkéa says the attackers came through the platform of one of its service providers and used the bank’s own account to make transfers. The bank has not named the provider or explained the precise technical route.
Was Fortuneo the entry point?
No, according to Arkéa. The bank said the attackers did not enter through Fortuneo, its online bank, and instead used a service provider’s platform.
What happens next?
French prosecutors and the anti-cybercrime office are investigating. The inquiry is expected to examine the supplier route and the transfers, while Arkéa may update its estimate as it determines how much money can be recovered.
Source: ThorstenMeyerAI.com
