🔍 Read the full analysis: The Arkéa Bank Hack: What We Know About The €100 Million on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on November 5 that around €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers reached it through a service provider, not Fortuneo or customer accounts; part of the money has been blocked, but the final loss and recovery prospects remain unknown.
Crédit Mutuel Arkéa said on November 5 that attackers stole around €100 million through fraudulent transactions from the French bank’s own account, in an incident it first disclosed the previous day. The bank says the attackers gained access through a service provider’s platform, while customer accounts and deposits were not affected.
In a question-and-answer statement issued on November 4, the bank said the attackers used Crédit Mutuel Arkéa’s own account to make transfers to other banking institutions. It said those transactions may have enabled the money to be converted into cryptocurrency through specialist platforms. The bank said the attackers did not use accounts held by customers of its federations or subsidiaries.
On November 5, Arkéa told Reuters that around €100 million had been stolen. Earlier, the bank had declined to confirm reports of $133 million, equivalent in those reports to about €118 million, saying it could validate only the order of magnitude. The bank said some of the funds had been blocked. The final amount lost is not yet known, and the available information does not establish how much of the money can be recovered.
Arkéa said the route into its systems was a platform operated by one of its service providers, but it has not identified the provider or described the technical method used. It said Fortuneo, its online banking subsidiary, was not the entry point and rejected human error on the bank’s part. Arkéa said it detected suspicious activity quickly, contained the attack and alerted relevant authorities. Some transactions were suspended as a precaution on November 4; the bank said almost all operations resumed that morning. Franceinfo reported that the banking app was unavailable for several hours.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from common bank fraud cases in which criminals take money directly from individuals or use stolen customer credentials. Arkéa says the funds came from the bank’s own account, making the event a reminder that a financial institution’s internal payment processes and third-party connections can also be targets.
The reported scale matters for banks and companies that rely on outside providers to connect systems or initiate transactions. Arkéa has not said how the provider’s platform was compromised or whether the provider’s systems were directly breached. Those details will shape what other institutions can learn from the incident. For customers, the bank’s statement that their accounts and deposits were unaffected is distinct from the unknown final recovery of the bank’s own funds.
The reports may also prompt fraud attempts that exploit public concern. Arkéa urged customers to watch for phishing. Customers should treat unsolicited requests for passwords or one-time SMS codes as suspicious and contact their bank through an independently verified channel.
Products Worth Considering
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
As an affiliate, we earn on qualifying purchases.
The November 4 Disclosure
The bank’s first public statement on November 4 said it had been the victim of an attack that enabled fraudulent operations. Arkéa said it informed the relevant supervisory bodies after detecting the incident and suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor’s office.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data processing system. France’s anti-cybercrime office is leading the inquiry, according to the source material. The investigation is intended to establish how the attack happened and who was responsible; no suspect or technical account of the intrusion has been publicly identified in the available statements.
Before Arkéa gave its account of the incident, media reports described a possible theft of $133 million, or about €118 million. That figure was not confirmed by the bank. Reports about a possible start date in late October and information circulating online from November 1 were attributed to Le Figaro, rather than confirmed by Arkéa. The bank has not said when the attack began.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
Losses and Intrusion Details Remain Open
The exact amount stolen and the amount recovered have not been established publicly. Arkéa has said around €100 million was stolen and that some funds were blocked, but it has not given a final accounting or said whether all blocked funds will be returned.
The bank has not disclosed the service provider’s identity, when the attack began, the technical vulnerability or access method, or whether the provider’s systems were themselves compromised. The prosecutor’s investigation may clarify those questions. The bank’s account that customer accounts were not used is a statement by Arkéa; the available source material does not provide an independent technical audit of that conclusion.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section and France’s anti-cybercrime office are investigating the intrusion. The inquiry is expected to examine how the service-provider platform was used, how transfers were authorised and where the funds went. Arkéa says it is cooperating with judicial and police authorities and has informed banking supervisors.
Further updates from the bank or investigators may clarify the final loss, the status of blocked funds and whether additional transactions were affected. Until then, the reported €100 million remains an approximate figure, and the recovery outcome is unresolved. Arkéa has advised customers to remain alert to phishing messages connected to the incident.
Key Questions
Were customer accounts used in the attack?
Arkéa says no. The bank says transfers were made from its own account, not from accounts belonging to customers of its federations or subsidiaries. It also says customer deposits were not affected.
How much money was stolen?
On November 5, Arkéa told Reuters that around €100 million was stolen. The bank has not confirmed the earlier reported figure of about €118 million, and says some funds have been blocked. The final loss is unknown.
How did attackers reach the bank?
Arkéa says the attackers came through a platform belonging to one of its service providers. It has not named the provider or publicly explained the technical method. The bank says Fortuneo was not the entry point.
Can customers get their money back?
The bank says customer accounts and deposits were not affected, so it has not reported customer losses to recover. The separate question of how much of the money taken from Arkéa’s own account can be recovered remains unresolved.
What should customers watch out for?
Arkéa has warned about possible phishing attempts that use the incident as a pretext. Do not share a password or one-time SMS code in response to an unsolicited message or call; contact the bank using a verified number or app.
Source: ThorstenMeyerAI.com
