🔍 Read the full analysis: The €100 Million Arkéa Hack: Reconstructing What We Know on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers entered through a service provider, not customer accounts or its Fortuneo online bank; part of the money has been blocked, but the final loss and recovery prospects are unknown.
In a statement issued on Nov. 4, Arkéa said attackers used the bank’s account to make transactions to other banking institutions. The bank said those transfers may have enabled the money to be converted into cryptocurrency through specialist platforms. It said customer accounts were not used and customer deposits were not affected.
The bank identified a supplier platform as the route into its systems but has not named the service provider. It said its online bank, Fortuneo, was not the entry point and described the incident as an external attack rather than a result of human error on its side. Arkéa said its security systems detected suspicious activity and that it had contained the attack.
Arkéa told Reuters on Nov. 5 that around €100 million was stolen. The bank had earlier declined to confirm a reported figure of $133 million, or about €118 million, saying it would validate only the order of magnitude. It has said some funds were blocked. The final amount lost, the sum recovered and whether the blocked funds will be returned have not been established publicly.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Supplier Became the Route In
The incident puts attention on a risk beyond customer-facing systems: a bank’s own accounts and payment processes can be targets, and outside suppliers may provide a path to them. Arkéa’s account of the attack indicates that a supplier platform was involved, although the bank has not yet disclosed the provider or the specific technical weakness.
For customers, the bank says deposits and customer accounts were not involved. The breach may still bring a separate risk: fraudulent messages that exploit the news to impersonate the bank or prompt people to disclose credentials. Arkéa advised customers to watch for phishing. A report about the incident is not a reason to share passwords or SMS verification codes with anyone claiming to be from the bank.
The reported amount is significant, but it should not be confused with a confirmed final loss. Some funds have been blocked, and both the total stolen and the recovery outcome remain unresolved. The investigation will need to establish how the supplier connection was used and whether the transfers can be traced or reversed.
Products Worth Considering
Canon SELPHY CP1500 Compact Photo Printer (White)
Apple MacBook Pro 2023 16.2 M2 Max 32GB 1TB SSD Space Gray
Canon imagePROGRAF PRO-1100 17-Inch Professional Wireless Inkjet Photo Printer
As an affiliate, we earn on qualifying purchases.
From Detection to Investigation
Arkéa disclosed the attack on Nov. 4, 2026. The bank said that after detecting the activity it notified relevant authorities and supervisory bodies and suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to French broadcaster franceinfo. The bank said almost all operations resumed during the morning.
In a statement later that day, Arkéa said the incident was under control and that customer assets were unaffected. Its more detailed question-and-answer statement said the attackers had used the bank’s own account and a service provider’s platform. On Nov. 5, the bank gave Reuters the approximate €100 million figure and said it had informed the European Central Bank, French banking supervisors and prosecutors.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4, according to the prosecutor’s office as reported by AFP. The case concerns suspected organised intrusion into a data processing system and is being led by France’s anti-cybercrime office. The investigation, rather than the bank’s public account alone, will determine the attack’s precise mechanics and responsibility.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
Losses and Attack Method Still Unclear
Arkéa has not disclosed when the intrusion began, named the service provider involved or explained the vulnerability or access method. Reports cited by French media have suggested the incident may have begun at a provider in late October, but that timeline has not been confirmed by the bank.
The precise amount stolen is also unsettled. The bank told Reuters the figure was around €100 million, while an earlier report cited about $133 million, or €118 million. Arkéa did not confirm that higher figure. It has said some money was blocked, but has not specified how much, whether all blocked funds can be recovered or what the final net loss will be.
It is not yet clear how the attackers obtained access, how long they had access, whether cryptocurrency conversion took place, or whether other organisations were affected. Authorities have opened an investigation, and allegations or early media reports should not be treated as findings of that inquiry.
Investigators Trace the Transfers
The Paris prosecutor’s investigation is expected to examine the intrusion, the supplier connection and the transfers from Arkéa’s account. The bank says it is working with judicial and police authorities to establish the attack’s origin and method. Further information may clarify the provider’s role, the precise amount involved and the extent to which funds can be recovered.
Arkéa has said the incident is contained and that most banking operations resumed after precautionary suspensions. Customers should follow communications through the bank’s official channels and be alert to messages that use the attack to request credentials or verification codes. The bank has not announced a public timetable for further disclosures.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts affected?
The bank says attackers did not use customer accounts and that customer deposits were not affected. The transfers came from an account belonging to the bank.
How much money was stolen?
Arkéa told Reuters on Nov. 5 that around €100 million was stolen. The bank has not confirmed an earlier reported figure of about €118 million, and the final loss remains unknown.
How did the attackers get in?
The bank says attackers used the platform of one of its service providers to reach Arkéa. It has not named the provider or described the technical route in detail.
Was Fortuneo involved as the entry point?
Arkéa said the attackers did not enter through Fortuneo, its online banking subsidiary. It said the route was a service provider’s platform.
Can the money be recovered?
The bank says part of the money has been blocked, but it has not disclosed the amount or confirmed how much will be returned. Recovery prospects remain unclear while investigators trace the transfers.
Source: ThorstenMeyerAI.com
