🔍 Read the full analysis: What We Know, Hour By Hour, About Arkéa’s €100 Million Hack on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said about €100 million was stolen in an attack that used the bank’s own account through a service provider. The bank says customer accounts and deposits were not affected; some transactions were suspended and later mostly resumed. Authorities are investigating, while the final amount and the route taken through the provider remain unclear.
Crédit Mutuel Arkéa said about €100 million was stolen in a cyberattack that used the bank’s own account to send transactions to other financial institutions, rather than drawing on customer accounts. The French cooperative bank said on November 4 that the attack came through a service provider’s platform; on November 5, it told Reuters the amount stolen was around €100 million. The bank says customer deposits were not affected, and a Paris prosecutor’s investigation is underway.
The bank said attackers used Crédit Mutuel Arkéa’s own account to make transactions to other banking institutions. In a question-and-answer statement issued on November 4, it said the operation did not pass through accounts belonging to customers of its federations or subsidiaries. The bank said the transfers may have allowed the attackers to convert the money into cryptocurrency through specialist platforms; that possible conversion route has not been independently confirmed in the source material.
Arkéa said the attackers reached it through a service provider’s platform, but has not identified the provider or explained how the platform was compromised. It said its online bank, Fortuneo, was not the entry point and characterized the attack as external rather than the result of human error at the bank. The bank said it was working with police and judicial authorities to determine the origin and method of the intrusion.
On the morning of November 4, the bank said it notified relevant authorities and supervisors and suspended some transactions as a precaution after detecting suspicious activity. Its banking app was unavailable for several hours, according to franceinfo. The bank said almost all operations resumed during the morning, and a statement at 1 p.m. described the incident as closed and under control. It later clarified that some transfers had been made from its own account. The amount remains an estimate: Arkéa had declined to confirm an earlier reported figure of €118 million, saying it would validate only the order of magnitude. It told Reuters the next day that around €100 million was stolen and said part of the money had been blocked.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The incident differs from a conventional account takeover in which criminals steal customers’ credentials or drain personal balances. Arkéa says the funds came from the bank’s own account, so the confirmed immediate exposure is the institution’s money rather than customer deposits. That distinction matters to customers, but it does not make the event minor: the reported loss is substantial, and the bank temporarily suspended some transactions while it responded.
The bank’s account of the attack also puts attention on third-party access and payment processes. A provider’s platform was the route into the bank, according to Arkéa, but the details of that access and the payment controls involved have not been disclosed. For other financial firms and businesses, the episode is a reminder that systems operated by suppliers can be part of the security perimeter when they can initiate or support financial activity. The source material does not establish whether a particular control failure caused the loss.
For customers, the bank’s statements that accounts and deposits were not affected are the clearest reassurance available. The event may also be used in fraudulent messages or calls. Customers should treat unsolicited requests for passwords or one-time codes with caution; the source material warns that banks will not ask customers to provide their password or an SMS code.
Products Worth Considering
LEVOIT Vital Pet Smart Air Purifier
Oura Ring 5 Smart Ring – Stealth, Size 11
Fitbit Charge 6 Fitness Tracker – Obsidian/Black
As an affiliate, we earn on qualifying purchases.
How the Timeline Took Shape
The bank has not said when the attack began. Some timing details come from media reports rather than Arkéa’s own statements, so they should not be treated as confirmed by the bank. Le Figaro reported that the incident began at a provider that had itself been hit in late October, and that information about the attack circulated on social media from November 1. Those details are reported, not confirmed by Arkéa.
By the morning of November 4, crypto news outlets were reporting a loss of about $133 million, equivalent to roughly €118 million in reports cited by the source material. At 10:29 a.m., franceinfo reported a loss of more than €100 million, citing a source close to the case. Arkéa’s first public statement, at 1 p.m., said the incident was under control and customer assets were unaffected. A fuller statement at about 5:30 p.m. described the bank’s own account and the service-provider route.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organized intrusion into a data processing system, according to reporting that cited the prosecutor’s office. The case is being handled by France’s anti-cybercrime office. On November 5, Arkéa gave Reuters its estimate of around €100 million and said it had informed the European Central Bank, French banking supervisors and prosecutors.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
What Investigators Still Need to Establish
The precise total stolen is not yet established publicly. Arkéa told Reuters the amount was around €100 million and said part of the money had been blocked, but the final figure and the amount recovered have not been disclosed. The earlier €118 million estimate was not confirmed by the bank.
The bank has not named the service provider, explained how attackers gained access to its platform, or detailed how the bank’s own account was used to authorize the transfers. It has said the attackers may have converted funds into cryptocurrency, but the source material does not confirm that this happened or say how much money, if any, can be recovered. The investigation’s findings, any arrests and the identity or motive of the attackers have not been reported.
Arkéa says customer accounts and deposits were not affected. The source material does not provide an independent audit of that statement or detail whether any customer data was accessed. The duration of the disruption to the app is described only as several hours in media reporting; the bank has not published a fuller account of the operational impact.
Investigation and Recovery Steps
The Paris prosecutor’s investigation is expected to establish how the service-provider platform was used, how the transfers were authorized and where the funds went. Arkéa says it is cooperating with judicial and police authorities and working to identify the attack’s origin and method. No public timetable for the investigation or next update from the bank is given in the source material.
The bank will also need to clarify the final loss and how much of the money has been blocked or recovered. For now, its public estimate remains around €100 million, with the recovery total unknown. Customers can follow direct updates from the bank and should be wary of messages or calls that exploit the incident to request login details or one-time codes. Businesses can review supplier access and payment authorization controls, without assuming that the details of Arkéa’s incident are already known.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
Arkéa told Reuters on November 5 that around €100 million was stolen. The bank has not published a final figure; it previously declined to confirm a reported €118 million estimate.
Were customer accounts or deposits affected?
The bank says attackers used its own account, not customer accounts, and says customer deposits were not affected. The source material does not include an independent audit of that statement.
How did the attackers get into the bank?
Arkéa says the attackers came through a service provider’s platform. It has not named the provider or explained the technical route. The bank says Fortuneo was not the entry point.
Has the stolen money been recovered?
The bank said part of the money had been blocked, but it has not disclosed how much was blocked, how much was recovered or the final loss.
What should Arkéa customers do?
The bank says customer assets were not affected. Customers should be alert to phishing attempts that use the story and should not provide passwords or SMS verification codes in response to unsolicited requests.
Source: ThorstenMeyerAI.com
