TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said on Nov. 4 that attackers used a service provider’s platform to carry out fraudulent transactions from the bank’s own account. On Nov. 5, it told Reuters that about €100 million was stolen; some funds have been blocked, but the amount recovered is unknown. The bank says customer accounts were not used and deposits are unaffected.
In statements on Nov. 4, the bank said attackers had “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It said the entry point was “through the platform of one of our service providers,” but did not identify the provider or describe how the platform was accessed. The bank said it had suspended some transactions as a precaution after detecting the attack and that almost all operations resumed during the morning.
The amount changed as information emerged. On Nov. 4, reports cited figures of $133 million, or about €118 million; the bank declined to confirm that sum, saying it would validate the order of magnitude. On Nov. 5, it told Reuters that around €100 million had been stolen. The bank said some funds had been blocked, but the final amount recovered has not been disclosed.
The bank said it notified competent and supervisory bodies and filed a complaint with the Paris prosecutor. Reuters reported on Nov. 5 that the bank had informed the European Central Bank, French banking supervisors and prosecutors. The Paris prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organised intrusion into a data processing system; France’s anti-cybercrime office is leading the case.
Crédit Mutuel Arkéa reports theft What the investigation has established
Attackers used a service provider’s platform to make fraudulent transfers from the bank’s own account. The bank says customer accounts and deposits were unaffected.
How the transfers happened
The bank says the transactions used its own account through a platform run by an unnamed provider.
- Used for fraudulent transfers to other banking players
- Some funds have been blocked
- Not used for the theft, according to the bank
- Deposits are reported unaffected
What the timeline shows
The amount shifted as reports emerged; the bank’s later estimate is about €100 million.
What remains unclear
The public statements leave important questions for businesses that depend on third-party payment services.
Provider not named
The bank has not identified the provider or explained how its platform was accessed.
Final amount unknown
Some funds were blocked, but the bank has not said how much was ultimately recovered.
Investigation and customer guidance
The case is examining the transfers and the route through the provider platform.
The Paris prosecutor’s cybercrime section opened an investigation; France’s anti-cybercrime office is leading it.
The bank advised customers to be alert. Treat requests for passwords or one-time SMS codes with suspicion.
A Bank’s Own Payment Account Was Targeted
The incident shows that a bank’s internal accounts and payment processes can be targeted alongside customer accounts. Because the bank says a supplier platform was involved, the investigation may also clarify how access granted to outside providers is monitored and controlled. The provider’s identity and role have not been made public.
For customers, the bank’s statement that deposits are unaffected distinguishes this case from a reported theft directly from customer accounts. The temporary unavailability of its app for several hours, reported by franceinfo, also shows how a response to suspected fraud can affect access to services even when customer balances are not the source of the stolen funds.
The scale matters to businesses that rely on third parties to initiate or support payments. It raises questions about controls around a company’s own treasury accounts and supplier access. The available information does not establish which specific control failed or whether the provider’s systems were the sole point of entry.
Products Worth Considering
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Apple MacBook Air 15-inch with M5 chip, 24GB RAM, 512GB SSD, Midnight
Bose QuietComfort Wireless Noise Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From Early Reports to Bank Confirmation
The bank did not disclose when the attack began. Le Figaro reported that a service provider was itself attacked at the end of October and that information about the incident began circulating on X from Nov. 1. Those details are media reports, not confirmed by the bank.
By the morning of Nov. 4, crypto news outlets and Le Télégramme were reporting a figure of $133 million, or €118 million, and naming Arkéa as the suspected victim. On Nov. 4 at 10:29 a.m., franceinfo reported a theft of more than €100 million, citing a source close to the case. The bank’s first public statement later that day said the incident was closed and under control, customer assets were unaffected and customers should be alert to phishing. A second statement at 5:30 p.m. addressed the bank’s own account, the service provider, Fortuneo and the amount.
Arkéa denied that its online bank Fortuneo was the entry point and said the incident did not result from human error on its side. Those are the bank’s statements; the public details of the technical investigation remain limited.
““Used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.””
— Crédit Mutuel Arkéa
The Provider and Recovery Sum Remain Unknown
The bank has not named the service provider, said when the attackers first gained access, or publicly detailed the method used to authorize the transactions. It has also not released a final accounting of the stolen funds or the amount recovered. The reported €100 million figure is the bank’s estimate given to Reuters on Nov. 5; the amount ultimately recovered may differ.
Some timeline details, including an attack on a provider in late October and information circulating online from Nov. 1, come from media reporting rather than the bank. The investigation may establish whether those reports describe the same event and how the transactions were carried out. No public findings from investigators were included in the available statements.
Investigators Trace the Transfers
France’s anti-cybercrime office is leading the investigation opened by the Paris prosecutor’s cybercrime section. Investigators will seek to establish how attackers used the provider platform, who carried out the transfers and where the money went. The bank’s next public accounting may clarify how much was blocked or recovered, but it has not announced a timetable.
The bank advised customers to watch for phishing attempts exploiting the incident. Customers should treat messages asking for passwords or one-time SMS codes with suspicion; the supplied source material says a bank will not ask customers to disclose those credentials.
Key Questions
Were customer accounts used to steal the money?
The bank says no. It says attackers used Crédit Mutuel Arkéa’s own account and that customer deposits are unaffected.
How much was stolen?
On Nov. 5, the bank told Reuters that around €100 million had been stolen. Earlier reports cited $133 million, about €118 million, but the bank initially declined to confirm that figure.
Has the money been recovered?
The bank said some funds had been blocked. It has not disclosed the final amount recovered.
How did attackers get access?
The bank said the attackers came through a platform belonging to one of its service providers. It has not named the provider or publicly explained the access method.
Who is investigating?
The Paris prosecutor’s cybercrime section opened a case on Nov. 4. France’s anti-cybercrime office is leading the investigation.
Source: Thorsten Meyer AI
