TL;DR
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Crédit Mutuel Arkéa said on November 4 that attackers used a service provider’s platform to carry out fraudulent transactions from the bank’s own account. On November 5, it told Reuters that around €100 million had been stolen; some funds have been blocked, but the final loss and recovery prospects are unknown. The bank says customer deposits were not affected, and French prosecutors have opened an investigation.
French cooperative bank Crédit Mutuel Arkéa said on November 4 that attackers used a service provider’s platform to carry out fraudulent transactions from the bank’s own account. The bank told Reuters the next day that around €100 million was stolen; it says customer deposits were not affected, while some of the money has been blocked.
The bank described the incident as an attack that enabled fraudulent operations. It said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” That account belonged to the bank, according to its statement; the bank said customer accounts were not used and customer deposits were unaffected.
Arkéa said the attackers gained access “through the platform of one of our service providers,” but has not identified the provider or explained how its platform was used. The bank denied that its online subsidiary Fortuneo was the entry point and ruled out human error on its side. Those statements do not establish the precise technical method or which controls failed.
On November 5, the bank told Reuters that about €100 million had been stolen. It had earlier declined to confirm reports of $133 million, or about €118 million, saying it would validate only the order of magnitude. The bank said some funds had been blocked. The final loss, including whether blocked funds will be recovered, has not been established.
Crédit Mutuel Arkéa theft timeline
Attackers used a service provider’s platform to make fraudulent transfers from the bank’s own account. The final loss and recovery prospects remain unknown.
What the bank says happened
The reported route raises questions for businesses that use outside platforms to support payment operations.
Arkéa says attackers gained access through a service provider’s platform; the provider and method are unknown.
Fraudulent transfers went from Arkéa’s own account to other banking players, the bank said.
After detecting the attack on November 4, Arkéa said it suspended some transactions as a precaution.
Customer impact and open questions
The bank’s statements clarify what it says was affected while leaving key details unresolved.
| Issue | What is known | Still unknown |
|---|---|---|
| Customer deposits | ✓ Unaffected, according to Arkéa | Related scam attempts remain a concern |
| Stolen funds | Some funds have been blocked | Final loss and recovery amount |
| Provider access | Platform of a service provider involved | Provider, access route and failed controls |
Investigation underway
The case may establish how the transfers were authorised and whether more money can be recovered.
The Bank’s Own Account Was Exposed
The incident highlights that bank cyber incidents can involve a financial institution’s own treasury and payment processes, not only customer accounts. Arkéa says the fraudulent transfers originated from its own account and passed through a service provider’s platform. That makes the provider relationship relevant to businesses that rely on outside systems to initiate or support payments.
For customers, the bank’s statement that deposits were unaffected is a specific assurance about this incident; it does not mean customers are insulated from related scams. Arkéa warned people to watch for phishing. News of a large theft can be used to impersonate a bank and seek passwords or one-time codes, so any such request should be treated cautiously.
The amount also matters because the bank has not yet provided a final accounting. Around €100 million is the figure it gave Reuters, while reports cited a higher amount. Some funds have been blocked, but the ultimate loss and any reimbursement or recovery remain unknown.
Products Worth Considering
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Dell XPS 13 9350 Laptop, 13.4-Inch WUXGA Display, Intel Core Ultra 7 256V, 16GB RAM, 1TB SSD
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the Timeline Took Shape
Arkéa said that once the attack was detected on November 4, it informed relevant and supervisory bodies and suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor. The bank’s first public statement that day described the incident as closed and under control, said customer assets were unaffected, and urged customers to watch for phishing. A later question-and-answer statement described the bank account and service provider involved.
France’s national reporting and media accounts added details with varying levels of confirmation. Franceinfo reported that the banking app was unavailable for several hours and that almost all operations resumed during the morning. It also cited a source close to the case who put the theft above €100 million. Reuters reported that crypto news outlets had circulated a figure of $133 million before Arkéa confirmed an approximate euro amount to the news agency on November 5.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data processing system, according to the source material. France’s anti-cybercrime office is leading the case. A report by Le Figaro said the attack may have begun at a provider in late October; that timing has not been confirmed by the bank.
““Used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.””
— Crédit Mutuel Arkéa
The Provider and Recovery Remain Unknown
The bank has not named the service provider, said when the attackers first gained access, or described the security weakness that enabled the transfers. A late-October start date comes from a Le Figaro report and is not confirmed by Arkéa. The public information also does not specify how many transactions were made or which receiving institutions handled them.
The amount should be treated as provisional. Arkéa told Reuters that around €100 million was stolen, while earlier reports put the amount at about €118 million. The bank said some funds were blocked, but has not disclosed how much, whether any money has been returned, or what the eventual net loss will be. Prosecutors have opened a case, but no findings or suspects have been identified in the material available.
Investigators and the Bank Must Account
The Paris prosecutor’s investigation, led by France’s anti-cybercrime office, is the next formal step described so far. The bank has said it informed the European Central Bank, French banking supervisors and prosecutors. Further updates would be needed to establish how the supplier platform was compromised, how transfers were authorised, and whether additional funds can be recovered.
Arkéa customers should rely on the bank’s official channels for incident updates and remain alert to messages that ask for passwords or SMS verification codes. For businesses, the reported route through a supplier puts payment permissions and third-party access among the issues to review, although the investigation has not yet established which specific control failed in this case.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on November 5 that around €100 million had been stolen. Earlier reports cited roughly €118 million, and the final loss is not yet known.
Were customer accounts or deposits affected?
Arkéa said the fraudulent transactions used the bank’s own account, not customer accounts, and that customer deposits were unaffected.
How did attackers get access?
The bank said the attackers came through a service provider’s platform. It has not named the provider or explained the technical route. It denied that Fortuneo was the entry point.
Can the stolen money be recovered?
The bank said some funds had been blocked. It has not said how much was blocked or whether those funds will be returned, so the recovery outcome remains unclear.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened an investigation on November 4, led by France’s anti-cybercrime office. No findings have been reported in the source material.
Source: Thorsten Meyer AI
