🔍 Read the full analysis: How The €100 Million Arkéa Hack Developed Over Several Hours on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through fraudulent transactions from the bank’s own account. The bank says attackers reached it through a service provider, not customer accounts or its online bank Fortuneo; investigators are examining the incident and part of the money has been blocked.
French cooperative bank Crédit Mutuel Arkéa said on Nov. 5 that attackers stole about €100 million from the bank’s own account, using a service provider’s platform to carry out transactions to other banking players. The bank says customer accounts were not used and customer deposits are not affected; French authorities have opened a criminal investigation.
The bank’s account of the incident is the main source for what happened. In a statement issued on Nov. 4, Arkéa said the attackers used its own account to make transactions to other financial institutions. The bank said those transfers may have enabled the money to be converted into cryptocurrency through specialist platforms. It said the attackers did not use accounts belonging to customers of its federations or subsidiaries.
Arkéa said the route into its systems was a platform operated by one of its service providers. It has not identified the provider publicly. The bank said Fortuneo, its online banking subsidiary, was not the entry point, and rejected human error on its side. It described the attack as sophisticated and said its security systems detected suspicious activity quickly. The precise method used to access the provider’s platform has not been disclosed.
The amount was initially uncertain. On Nov. 4, the bank declined to confirm reports of $133 million, or about €118 million, saying it could validate only the order of magnitude. The following day, it told Reuters that around €100 million had been stolen. Arkéa has said some of the funds have been blocked, but has not given a final accounting of what was taken, recovered or remains at risk.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Payment Route Was Targeted
The incident highlights that a financial institution’s exposure is not limited to the accounts it holds for customers. A bank’s own treasury and payment accounts, as well as the outside platforms that can initiate or facilitate transactions, can also become targets. The reported loss is substantial, although the final amount and recoveries remain unknown.
For customers, Arkéa says their accounts and deposits were not involved. The immediate concern is instead the possibility of follow-on phishing: criminals may use news of the attack to pose as bank staff and seek passwords or one-time codes. The bank advised customers to remain alert. Businesses that rely on suppliers with access to payment processes may also want to review how those connections are monitored and controlled, without assuming the details of Arkéa’s breach apply to their own systems.
Popular right now
Ninja DualBrew Pro Specialty Coffee Maker, Black, CFP301
Dyson V15 Detect Cordless Vacuum
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
Arkéa has not said when the intrusion began. A timeline assembled from the source report and other cited coverage places the public disclosure across several days, but some early entries are media reports rather than facts confirmed by the bank. Le Figaro reported that the attack began at a service provider in late October and that information began circulating on X from Nov. 1. Arkéa has not confirmed those dates.
By the morning of Nov. 4, news outlets were reporting a suspected theft and a figure of about $133 million. Arkéa said it notified relevant supervisory bodies after detecting the attack and suspended some transactions as a precaution. Its banking app was unavailable for several hours, according to franceinfo. The bank said almost all operations resumed during the morning.
At about 1 p.m. on Nov. 4, Arkéa issued a statement saying the incident was contained and customer assets were unaffected. A more detailed question-and-answer statement later that day described the bank account and service-provider route. The Paris prosecutor’s cybercrime section opened an investigation that morning, according to the prosecutor’s office as reported by AFP. France’s anti-cybercrime office is leading the inquiry.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its Nov. 4 statement
The Attack’s Start and Recovery Remain Unknown
Several central details have not been made public. Arkéa has not stated when the attack began, named the affected service provider, or described how the attackers gained access to its platform. Reports placing the start in late October and the first online discussion on Nov. 1 have not been confirmed by the bank.
The final financial loss is also unsettled. The bank told Reuters that around €100 million was stolen and said some money was blocked, but it has not said how much has been recovered or whether blocked funds will be returned. It has not confirmed the earlier reported figure of €118 million. The investigation may establish the route, perpetrators and exact amount, but those findings are not yet available.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section opened a case on Nov. 4 into suspected organised intrusion into a data-processing system. France’s anti-cybercrime office is leading the investigation. Arkéa says it is working with judicial and police authorities to establish the origin of the attack and its method, while the bank has informed relevant European and French supervisory bodies.
Further updates are expected to clarify the amount ultimately lost, the share of funds that can be recovered, and the service provider’s role. Until authorities or the bank release those details, the reported timeline and technical path should be treated with care. Arkéa has told customers to watch for phishing; it says customers should never share bank passwords or SMS verification codes in response to a call, message or email.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
Arkéa says customer accounts were not used in the transactions and customer deposits are not affected. It says the money came from the bank’s own account.
How much money was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. The bank has not given a final figure, and it previously declined to confirm a reported €118 million amount.
How did the attackers reach the bank?
Arkéa says attackers came through a service provider’s platform. The provider has not been named, and the bank has not publicly described the technical route in more detail.
Has any of the money been recovered?
The bank says part of the money has been blocked. It has not disclosed how much, whether the funds will be returned, or the final amount recovered.
What should customers do now?
Arkéa has advised customers to be alert to phishing attempts that exploit the incident. Do not share passwords or SMS codes with anyone claiming to represent the bank.
Source: ThorstenMeyerAI.com
