Executive Summary
The Crédit Mutuel Arkéa cyberattack, confirmed by the French bank on 4 November 2026, let attackers carry out fraudulent transactions from the bank’s own account after getting in through a service provider’s platform. The cooperative group, based near Brest with more than 5.8 million members and customers, says customer assets are untouched and the incident is contained. Some transfers were delayed while it checked its systems. The bank has not confirmed a circulating estimate of €118 million ($133 million) and says only that the order of magnitude is right. The Paris prosecutor’s cybercrime section has opened an investigation. The supplier has not been named.
Crédit Mutuel Arkéa Cyberattack Began at a Supplier
In a question-and-answer statement published later the same day, Crédit Mutuel Arkéa said the attackers used its own account to send transactions to other banks. Those transactions then potentially let them convert the money into cryptocurrency through specialised platforms. No customer accounts in the group’s federations or subsidiaries were used, the bank said.
It also rejected press reports naming Fortuneo, its online banking subsidiary, as the way in. The attackers went through the platform of one of its service providers and reached the bank directly. Arkéa ruled out human error on its side and said the attack came from outside.
It hasn’t said which provider or how that platform was compromised.
€118 Million Figure Remains Unconfirmed
The €118 million estimate traces back to blockchain investigator ZachXBT, who began flagging large unauthorised withdrawals from crypto exchange accounts on 2 November, according to a published report. Asked directly whether that sum was stolen, the bank replied that it does not confirm the figure and can only validate the order of magnitude. Part of the funds has been blocked and other recovery steps are under way, it said, adding that the amounts involved pose no threat to the group’s financial strength. Its press release puts the group’s total balance sheet at €211.5 billion.
Paris Prosecutors Open an Organised-Hacking Inquiry
On detecting the Crédit Mutuel Arkéa cyberattack, the group informed the competent supervisory bodies and temporarily suspended certain transactions as a precaution, the press release says. Almost all operations resumed the same morning after checks and extra security measures.
The cybercrime section of the Paris prosecutor’s office received a complaint from the group on the morning of 4 November and opened an investigation into intrusion into an automated data processing system by an organised gang, the prosecutor’s office said, according to a second published report. The case went to OFAC, the French police office dedicated to cybercrime. As of that evening nobody had claimed the attack.
The bank has also told customers to expect phishing attempts exploiting the news. It describes the warning as preventive and has reported no theft of customer data.
Supplier, Detection Time and Final Loss Still Undisclosed
Arkéa has not named the service provider or said what the platform does for the bank. It gave no time of detection, did not say which supervisors it notified and has published no figure for the money recovered so far.
A Supplier Route Swedish Banks Have Already Flagged
The attackers never touched customer accounts; they used a supplier’s access to move the bank’s own money. Finance Sweden’s Threat Assessment for Sweden’s Banks 2026, published on 4 May 2026, says cyber extortion increasingly exploits supplier dependencies and that third-party risks have grown. Under DORA a Swedish bank in Arkéa’s position would report to Finansinspektionen. Delegated Regulation (EU) 2025/301 sets the initial notification at four hours from classifying an incident as major and no later than 24 hours after becoming aware of it.
References
- Crédit Mutuel Arkéa annonce avoir été victime d’une attaque
- Informations complémentaires suite à l’attaque dont le Crédit Mutuel Arkéa a été victime
- Threat Assessment for Sweden’s Banks 2026
- Commission Delegated Regulation (EU) 2025/301
- Lathund Dora incidentrapportering
- Published report
- Published report
This post is also available in:
Svenska
