🔍 Read the full analysis: The €100 Million Arkéa Hack: Questions About The Bank’s Own Account on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa said on Nov. 5 that about €100 million was stolen through transactions made using the bank’s own account. The bank says attackers accessed it through a service provider, not customer accounts or its online bank Fortuneo. Investigators are examining the attack, and the amount recovered and the provider’s identity remain unclear.
French cooperative bank Crédit Mutuel Arkéa said on Nov. 5 that attackers stole about €100 million using the bank’s own account, rather than customer accounts. The bank says the attackers reached it through a platform operated by an unnamed service provider; a Paris investigation is examining the intrusion and fraudulent transactions.
In a question-and-answer statement issued on Nov. 4, Arkéa said attackers used the bank’s own account to make transactions to other banking institutions. The bank said those transactions may have enabled the money to be converted into cryptocurrency through specialized platforms. It said the attackers did not use accounts belonging to customers of its federations or subsidiaries, and that customer deposits were not affected.
On Nov. 5, the bank told Reuters that around €100 million was stolen. Arkéa had previously declined to confirm reports of $133 million, or about €118 million, saying it could only validate the order of magnitude. The final amount has not been established publicly. The bank has said that some of the funds have been blocked, but has not disclosed how much or how much may be recoverable.
Arkéa said the attackers entered through a service provider’s platform and denied that its online bank Fortuneo was the entry point. It described the incident as an external, sophisticated attack and said it did not result from human error on its side. The bank said it detected suspicious activity, suspended some transactions as a precaution and notified relevant authorities. Its services were disrupted for several hours on Nov. 4, according to Franceinfo; Arkéa said almost all operations resumed that morning.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The incident differs from fraud that targets individuals’ cards, passwords or savings: the bank says the funds came from its own account. That makes the case relevant to how financial institutions protect treasury operations and the systems that authorize or initiate payments. Arkéa’s account also shows how a supplier connection can become part of a bank’s security perimeter, even when customers’ accounts are not the route used.
For customers, Arkéa’s statement that customer deposits were not affected addresses the immediate concern about personal balances. It does not mean customers are insulated from follow-on risks: the bank urged them to watch for phishing attempts linked to the incident. Anyone receiving a message claiming to be about the theft should treat requests for passwords or one-time SMS codes with caution and contact the bank through its official channels.
The financial impact and recovery prospects are still unknown. The amount cited by Arkéa is substantial, but the available information does not establish how much was blocked, whether additional funds can be traced, or what the eventual loss will be. Those answers matter to the bank, its supervisors and customers seeking clarity about the incident’s consequences.
Products Worth Considering
Arlo Pro Wireless Security Camera, 2K HDR, 6th Gen, 4-Camera Kit
Arlo Essential Outdoor Pan-Tilt-Zoom Security Camera, 2K, Wired, 2-Camera Pack
Arlo Ultra 4K HDR Wireless Security Camera (3rd Gen), 3-Camera Kit with SmartHub
As an affiliate, we earn on qualifying purchases.
How Arkéa Disclosed the Attack
Arkéa announced on Nov. 4, 2026, that it had been the victim of an attack enabling fraudulent operations. Its first public statement said the incident was contained and customer assets were unaffected. A later question-and-answer release gave more detail about the use of the bank’s own account, the service provider route and the bank’s denial that Fortuneo was involved as the entry point.
The bank filed a complaint with the Paris prosecutor’s office. The prosecutor’s cybercrime section opened an investigation on the morning of Nov. 4 into suspected organized intrusion into a data-processing system. France’s anti-cybercrime office is leading the inquiry, according to the supplied reporting. Arkéa said it informed the relevant supervisory bodies; Reuters reported that these included the European Central Bank and French banking supervisors.
Some early details remain reports rather than bank-confirmed facts. Le Figaro reported that the attack began at a supplier in late October and that information about it circulated on social media from Nov. 1. The bank has not publicly confirmed when the intrusion began. Reports of an initial $133 million figure also preceded Arkéa’s Nov. 5 statement that about €100 million was stolen.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued Nov. 4
What Investigators Have Yet to Establish
The service provider has not been identified, and Arkéa has not publicly explained which systems or permissions were exploited. The bank has not said when the attack began, how long attackers had access, or how the fraudulent transactions were authorized. Those details are likely to be central to the ongoing investigation.
The amount also remains subject to clarification. Arkéa’s latest figure is around €100 million, while earlier media reports cited approximately €118 million. The bank has said some funds were blocked, but has not provided a recovery total or indicated whether the blocked money will be returned. The investigation has not publicly named suspects or described any charges.
Arkéa says customers’ accounts were not used and their deposits were unaffected. The public information does not yet provide an independent account of the attack or its full operational impact. Claims about its timing and supplier’s earlier exposure remain attributed reports, not details confirmed by the bank.
Investigation and Fund Recovery
French investigators are working to establish the attack’s origin and method, while the bank says it is cooperating with judicial and police authorities. The next significant updates would include identification of the affected service provider, a clearer account of how the attackers initiated the payments and a final estimate of the amount stolen.
Arkéa has not provided a timetable for further disclosures or said when it will know how much money can be recovered. Customers should follow notices issued through the bank’s official channels and be alert to messages that exploit the news. Businesses can also review which external providers can access systems involved in payment approval, while avoiding assumptions about Arkéa’s specific security failures before investigators publish findings.
Key Questions
Were customer accounts used in the Arkéa theft?
Arkéa says customer accounts were not used and that customer deposits were not affected. The bank says the transactions used its own account.
How much money was stolen?
On Nov. 5, Arkéa told Reuters that around €100 million was stolen. It had earlier declined to confirm a reported figure of about €118 million. The final amount has not been publicly established.
How did the attackers reach the bank?
Arkéa says they came through a service provider’s platform. The bank has not named the provider or explained the specific vulnerability or access path.
Has any of the money been recovered?
The bank says part of the funds has been blocked, but it has not said how much was blocked or whether those funds will be returned.
What should Arkéa customers do?
Arkéa has warned customers about possible phishing attempts connected to the incident. Use the bank’s official channels to check messages, and do not share passwords or one-time SMS codes in response to unsolicited requests.
Source: ThorstenMeyerAI.com
