TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Crédit Mutuel Arkéa said attackers used its own account to make fraudulent transactions through a service provider, and told Reuters on November 5 that around €100 million was stolen. The bank says customer deposits were unaffected; some money has been blocked, but the final loss and recovery prospects are not yet known.
Crédit Mutuel Arkéa said attackers used the bank’s own account to make fraudulent transactions through a service provider, and told Reuters on November 5 that around €100 million was stolen. The bank said customer accounts were not used and customer deposits were unaffected; some of the money has been blocked, while the final loss remains unknown.
The bank announced the incident on November 4, describing itself as “the victim of an attack that enabled fraudulent operations.” In a follow-up statement, it said the attackers used its own account to send transactions to other banking institutions. It has not disclosed when the attack began or how many transactions were involved.
Crédit Mutuel Arkéa said the route into its systems was the platform of one of its service providers. The provider has not been named. The bank said Fortuneo, its online banking subsidiary, was not the entry point and ruled out human error on its side. Those statements describe the bank’s account of the incident; the investigation is ongoing.
On November 4, the bank said it had alerted the relevant authorities and supervisors after detecting the attack and had suspended some transactions as a precaution. It said almost all operations resumed that morning. The bank later said the incident was closed and under control. Its November 5 estimate to Reuters was around €100 million stolen. Earlier reports put the amount at $133 million, or about €118 million, but the bank did not confirm that figure, saying it could validate only the order of magnitude.
How €100 million left Crédit Mutuel Arkéa
The bank says attackers used its own account through a service provider’s platform. Customer deposits were unaffected, while the final loss and recovery remain unknown.
How the route worked
The bank says fraudulent transactions came from its own account through a service provider platform.
The bank identified a service provider’s platform as the route into its systems. The provider has not been named.
Attackers used the bank’s own account to send transactions to other banking institutions.
The bank says some money was blocked and operations resumed almost entirely on November 4.
What the bank says was affected
The bank’s account of the incident distinguishes its own funds from customer deposits.
- Fraudulent transactions used the bank’s own account.
- Some money has been blocked; the final loss is unknown.
- The bank says customer accounts were not used.
- Customer deposits were unaffected.
What remains unclear
The investigation is ongoing, and key details have not been publicly confirmed.
Final loss
The amount ultimately lost and the recovery prospects are not yet known.
Attack details
The provider, start time, transaction count and technical steps have not been disclosed.
Transfers traced
The Paris prosecutor’s cybercrime section opened an investigation on November 4.
A Bank’s Own Account Was Targeted
The incident shows that a bank’s exposure can extend beyond customer accounts. Treasury accounts and payment processes can also be targets, and a supplier platform with access to those processes may create a route into them. For financial institutions and businesses, the case puts attention on how third parties connect to systems that can initiate or route payments.
For Crédit Mutuel Arkéa customers, the bank says their deposits were not affected. The incident may still prompt concern and create an opening for fraudsters to impersonate the bank. The bank advised customers to watch for phishing attempts. Readers should treat unsolicited messages about the incident cautiously, particularly requests for passwords or one-time codes.
Products Worth Considering
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Dell Pro 14 Plus P1425 14-Inch Portable Monitor
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
How the Incident Became Public
The bank’s first public statement came on November 4. It said the attack had been detected, some transactions suspended, and the incident brought under control. A second statement that evening answered questions about the bank’s own account, the supplier route, Fortuneo and the amount involved.
Some details circulating before and after the announcement came from media reports rather than the bank. Le Figaro reported that the attack began at a service provider in late October and that information about it circulated on X from November 1. Those details have not been confirmed by Crédit Mutuel Arkéa. Reports of a $133 million loss also preceded the bank’s approximate €100 million estimate to Reuters on November 5.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data processing system. France’s anti-cybercrime office is leading the case, according to the source material. The bank said it informed the European Central Bank, French banking supervisors and prosecutors.
““The victim of an attack that enabled fraudulent operations.””
— Crédit Mutuel Arkéa
Loss and Recovery Still Unsettled
The final amount stolen is not established. Crédit Mutuel Arkéa gave Reuters an estimate of around €100 million and said part of the money had been blocked. The source material does not give the amount blocked, how much may be recovered, or whether any funds have been returned.
The bank has not named the service provider or explained the technical steps that allowed the transactions. The start time, number of transactions and any potential impact beyond the bank’s own account also remain unclear. The investigation may establish those details, but they have not been publicly confirmed so far.
Investigators Trace the Transfers
The Paris prosecutor’s investigation is the next public process to watch. Investigators will seek to establish how the supplier platform was accessed, how the transactions were routed and whether the blocked funds can be recovered. No recovery timetable or final loss figure has been announced.
Crédit Mutuel Arkéa may provide further details as the investigation progresses. For now, the bank says its operations are under control and customer deposits are unaffected. Customers should rely on official bank communications and avoid sharing passwords or SMS codes in response to messages claiming to address the incident.
Key Questions
Was the money taken from customer accounts?
No. The bank says the money came from its own account and that customer accounts were not used. It says customer deposits are unaffected.
How much was stolen?
Crédit Mutuel Arkéa told Reuters on November 5 that around €100 million was stolen. Some money has been blocked, but the final loss is not known.
How did the attackers get in?
The bank said the attackers came through the platform of one of its service providers. It has not named the provider or publicly explained the technical details.
Was Fortuneo involved as the entry point?
Crédit Mutuel Arkéa said Fortuneo was not the entry point. That is the bank’s statement; the investigation remains underway.
What should customers do?
The bank advised customers to watch for phishing attempts. Be cautious with messages about the incident and do not share passwords or SMS codes in response to unsolicited requests.
Source: Thorsten Meyer AI
