🔍 Read the full analysis: €100 Million From The Bank’s Own Account: The Arkéa Hack Explained on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said about €100 million was stolen after attackers used the bank’s own account to send fraudulent transactions through a service provider’s platform. The bank says customer accounts and deposits were not affected; some funds have been blocked, but the final loss and recovery prospects are not known.
French cooperative bank Crédit Mutuel Arkéa said about €100 million was stolen in a cyberattack in which attackers used the bank’s own account to make fraudulent transactions to other financial institutions. The bank said the route into its systems was through a service provider’s platform, not customers’ accounts, and that customer deposits were not affected.
Arkéa announced on November 4 that it had been “the victim of an attack that enabled fraudulent operations.” In a question-and-answer statement issued later that day, the bank said the attackers used an Arkéa account to make transfers to other banking institutions. It said those transactions may have enabled the money to be converted into cryptocurrency through specialist platforms. That possible conversion route is the bank’s description; the full flow of funds has not been publicly established.
On November 5, Arkéa told Reuters that around €100 million had been stolen. The bank had earlier declined to confirm reports of $133 million, or about €118 million, saying it would validate only the “order of magnitude.” Arkéa said some of the money had been blocked. It has not published a final loss figure or said how much, if any, is expected to be recovered.
The bank said the attackers reached it through a platform belonging to one of its service providers, which it has not named. Arkéa said its online bank Fortuneo was not the entry point and described the incident as an external attack rather than an error by its own staff. It said suspicious activity was identified quickly, some transactions were suspended as a precaution, and operations were almost entirely resumed during the morning of November 4.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Was Targeted
The incident differs from familiar bank fraud in which criminals take money from individual customers. Arkéa says the transfers came from the bank’s own account, while customer accounts were not used. That distinction matters for customers, but it does not make the event financially minor: the amount disclosed to Reuters is about €100 million, and the bank says part of it was blocked.
The reported route also draws attention to the access and payment capabilities of outside service providers. A supplier’s platform can be a security risk if it can initiate or enable transactions, even when a bank’s customer-facing systems are not the point of entry. The case may prompt financial institutions and other businesses to review how third parties are authenticated, monitored and restricted. That is a broader lesson from the reported method, not a finding about the specific provider’s security, which has not been identified.
For Arkéa’s customers, the bank’s statements indicate that deposits were not affected by the transfers. The event may still create practical risks, including service disruption and follow-on attempts to exploit public concern through phishing messages. Customers should treat unexpected requests for passwords or one-time security codes as suspicious and verify communications through official bank channels.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Bose QuietComfort Wireless Noise Cancelling Headphones, Black
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
What Arkéa Has Disclosed So Far
Arkéa is a cooperative banking group based near Brest in Brittany. The source material says it includes the Crédit Mutuel federations of Brittany and the South-West and about 40 subsidiaries, including Fortuneo. The group reports more than 5.8 million members and customers, 12,073 employees and total assets of €211.5 billion. Those figures describe the scale of the institution; they do not change the bank’s statement that customer accounts were not the source of the stolen money.
On the morning of November 4, the bank said it informed relevant supervisory bodies after detecting the attack and suspended some transactions as a precaution. Its app was unavailable for several hours, according to franceinfo. Arkéa filed a complaint with the Paris prosecutor’s office. The prosecutor’s cybercrime section opened an investigation that morning into suspected organised intrusion into a data-processing system, with France’s anti-cybercrime office leading the inquiry.
Some early reports put the amount at $133 million, or about €118 million. Arkéa did not confirm that figure. Reuters reported on November 5 that the bank gave an estimate of around €100 million, while saying that some funds had been blocked. Reports about an attack beginning at a provider in late October and information circulating online from November 1 have been attributed to Le Figaro in the supplied material; Arkéa has not confirmed those dates.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 statement
The Provider and Recovery Remain Unknown
The bank has not named the service provider or explained precisely how access to its platform enabled transfers from Arkéa’s account. The technical method, the time the attackers first gained access and whether other systems were exposed have not been made public. The investigation is intended to establish the attack’s origin and method.
The exact financial outcome is also unsettled. Arkéa has put the amount at around €100 million, said some funds were blocked and has not supplied a final accounting. It is not clear how much was recovered, where the remaining money is, or whether cryptocurrency conversion occurred in this case. Earlier reports of a €118 million figure remain unconfirmed by the bank.
Arkéa said customer accounts and deposits were not affected. The source material does not provide an independent forensic assessment or detail what information, if any, was accessed. It also does not give a timeline for the investigation or say whether the bank will publish a further technical report.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section has opened an investigation, led by France’s anti-cybercrime office. Investigators are examining the intrusion and the transactions, while the bank says it is working with judicial and police authorities to determine how the attackers reached its systems. The provider’s identity and any findings about its role have not been disclosed.
Arkéa will need to clarify the final amount lost, how much money was blocked or recovered, and whether any service-provider access has been changed. Customers should follow notices posted through the bank’s official channels and be alert to messages impersonating the bank. Arkéa has warned customers about phishing; it says the incident itself did not involve their accounts.
Key Questions
Was money taken from Arkéa customers’ accounts?
No, according to the bank. Arkéa said the attackers used the bank’s own account and did not go through customer accounts. It said customer deposits were not affected.
How much money was stolen?
On November 5, Arkéa told Reuters that around €100 million had been stolen. The bank said some funds had been blocked, but the final loss and recovery amount are not known. It did not confirm earlier reports of about €118 million.
How did the attackers reach the bank?
Arkéa said they came through a platform belonging to one of its service providers. The bank has not named the provider or publicly explained the technical details.
Was Fortuneo involved as the entry point?
Arkéa said the attackers did not enter through Fortuneo, its online bank. The bank identified a service provider’s platform as the route instead.
What should customers do now?
Customers should use Arkéa’s official channels for updates and be cautious of unsolicited messages about the incident. Do not share passwords or one-time security codes in response to a message or call claiming to be from the bank.
Source: ThorstenMeyerAI.com
