TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said around €100 million was stolen through fraudulent transactions from the bank’s own account, using a service provider platform. The bank says customer accounts and deposits were not affected; some funds have been blocked, but the amount recovered is unknown. French authorities opened an investigation on 4 November.
French cooperative bank Crédit Mutuel Arkéa said around €100 million was stolen in fraudulent transactions made from the bank’s own account, after attackers accessed a platform belonging to one of its service providers. The bank says customer accounts and deposits were not affected; French authorities opened a cybercrime investigation on 4 November.
The bank said the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.” It identified a service provider’s platform as the route used, but has not named the provider. The bank said its online bank, Fortuneo, was not the entry point and ruled out human error on its side.
On 5 November, Crédit Mutuel Arkéa told Reuters that about €100 million had been stolen. Earlier reports put the amount at $133 million, or about €118 million. The bank had declined to confirm that figure, saying it would validate only the order of magnitude. It said some funds had been blocked; the final amount recovered is not known.
The bank said it notified relevant authorities and supervisory bodies after detecting the attack and suspended some transactions as a precaution. Its banking app was unavailable for several hours on 4 November, franceinfo reported. The bank said almost all operations resumed that morning and later described the incident as closed and under control.
Crédit Mutuel Arkéa reports about €100 million stolen
Fraudulent transfers were made from the bank’s own account through a service provider’s platform. The bank says customer accounts and deposits were not affected.
How the reports developed
The bank has not said when the attack began.
What the bank says was affected
The reported route involved the bank’s own funds, not customer deposits.
Bank account targeted
The bank said fraudulent transactions were made from its own account to other banking players.
Deposits not affected
The bank says customer accounts and deposits were not affected and warns customers to watch for phishing.
Identity undisclosed
Attackers used a service provider’s platform. The bank has not named the provider or explained how access was gained.
What remains to be established
Investigators are tracing the transfers and examining how the platform was used.
- How the attackers accessed the service provider’s platform
- How much money was blocked or ultimately recovered
- What controls were bypassed and when the intrusion began
The Bank’s Own Account Was Targeted
The incident shows how a financial institution’s payment systems and supplier access can be targeted even when customers’ own accounts are not the source of stolen funds. Here, the bank says transfers were made from its own account through a service provider’s platform. The provider’s identity and the specific weaknesses that enabled the transactions have not been disclosed.
For customers, the bank’s account of the incident means there is no reported impact to customer deposits or accounts. The bank warned customers to watch for phishing attempts that exploit the news. For other companies, the reported route highlights that suppliers with access to systems or payment processes can form part of an organization’s security exposure. The investigation may clarify how the transactions were authorized and what controls were bypassed.
Products Worth Considering
Apple MacBook Air 13.6-inch with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
As an affiliate, we earn on qualifying purchases.
How the Reports Developed
The bank has not said when the attack began. Le Figaro reported that it started at a service provider that had itself been attacked in late October; that account has not been confirmed by the bank. The same paper reported that information began circulating on X from 1 November. By the morning of 4 November, crypto news outlets and Le Télégramme were reporting a figure of $133 million, or €118 million.
On the morning of 4 November, the bank said it had detected the attack, notified competent and supervisory bodies, and suspended some transactions as a precaution. It filed a complaint with the Paris prosecutor. At 10:29 that day, franceinfo reported more than €100 million stolen, citing a source close to the case. At 13:00, the bank issued its first statement, saying the incident was under control and customer assets were unaffected. A second statement at 17:30 addressed the bank’s own account, the service provider, Fortuneo and the reported amount.
That evening, the Paris prosecutor’s office confirmed to AFP that it had opened an investigation that morning. On 5 November, the bank gave Reuters its estimate of around €100 million and said it had informed the European Central Bank, French banking supervisors and prosecutors.
““Used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.””
— Crédit Mutuel Arkéa
The Provider and Recovery Remain Unknown
The bank has not named the service provider, explained precisely how attackers gained access to its platform, or said when the intrusion began. Reports that the provider was attacked in late October and that information circulated online from 1 November remain attributed to Le Figaro and have not been confirmed by the bank.
The amount of money ultimately recovered is also unclear. The bank said some funds were blocked, but has not given a total for blocked or recovered funds. Although it described the incident as under control, details about the fraudulent transactions, the attackers and any lasting operational effects have not been made public in the source material.
Investigators Will Trace the Transfers
The Paris prosecutor’s cybercrime section opened a case on the morning of 4 November into organised intrusion into a data processing system. France’s anti-cybercrime office is leading the investigation. Investigators will need to establish how the service provider’s platform was used, trace the transfers and determine what money can be recovered.
The bank may provide further information as the investigation progresses. For customers, its stated guidance is to be alert to phishing that uses the incident as a pretext; it says customer deposits are not affected. The bank has not announced a timetable for further updates.
Key Questions
How much money was stolen from Crédit Mutuel Arkéa?
The bank told Reuters on 5 November that around €100 million was stolen. Earlier reports cited $133 million, or about €118 million, but the bank did not confirm that specific figure.
Were customer accounts or deposits affected?
Crédit Mutuel Arkéa said the money came from the bank’s own account and that customer accounts and deposits were not affected.
How did the attackers get in?
The bank said attackers used a platform belonging to one of its service providers. It has not named the provider or explained the precise method of access.
Has the stolen money been recovered?
The bank said some funds had been blocked, but it has not disclosed how much was blocked or recovered. The final recovery figure remains unknown.
Who is investigating the attack?
The Paris prosecutor’s cybercrime section opened an investigation on 4 November. France’s anti-cybercrime office is leading the case.
Source: Thorsten Meyer AI
