By Thorsten Meyer | November 5, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- What happened: On 4 November 2026 the French cooperative bank Crédit Mutuel Arkéa announced that it had been “the victim of an attack that enabled fraudulent operations”. Its own statements are the primary source for everything below.
- The money came from the bank, not from customers. In its own words, the attackers “used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players”. No customer accounts were used, and the bank says customer deposits are not affected.
- About €100 million. On 5 November the bank told Reuters that around €100 million had been stolen. It had earlier declined to confirm a reported $133 million (€118 million) and would only “validate the order of magnitude”. Part of the money has been blocked; the final figure is not known.
- The way in was a supplier. The attackers came “through the platform of one of our service providers”, the bank says. It has not named the provider. It denies that its online bank Fortuneo was the entry point, and rules out human error on its side.
- Investigation: the Paris prosecutor’s cybercrime section opened a case on the morning of 4 November for organised intrusion into a data processing system, led by France’s anti-cybercrime office.
- For businesses: a bank’s own treasury account is an attack surface, and so is every supplier who can start a payment. For customers: expect phishing that uses this story; your bank will never ask for your password or an SMS code.
Most bank heists in the news are about customers: stolen card numbers, drained savings, fake advisers on the phone. This one is different. The money that left Crédit Mutuel Arkéa this week did not come out of anyone’s current account. It came out of the bank’s own.
Crédit Mutuel Arkéa is not a small player. Based near Brest in Brittany, it groups the Crédit Mutuel federations of Brittany and the South-West with about forty subsidiaries, including the online bank Fortuneo. It reports more than 5.8 million members and customers, 12,073 employees and total assets of €211.5 billion. The head of a security firm told Reuters the attack was unprecedented in Europe. A French security adviser quoted by Le Monde called it “an attack of unprecedented scale and damage. Normally, this does not happen to banks.”
What follows separates what the bank has confirmed from what has only been reported, and ends with what companies and customers can take from it. It comes less than a week after the $6.3 billion Binance hack, which we followed minute by minute. That was a crypto exchange. This is a traditional bank.
Products Worth Considering
DJI Mic 2 Wireless Microphone System (2 Transmitters, Receiver, Charging Case)
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
Hour by hour: what is documented
The bank has not said when the attack began. Here is every time stamp we could confirm, in Paris time. Items marked “reported” come from a single outlet and are not confirmed by the bank.
- Late October (reported): Le Figaro, which is paywalled, reports that the attack started at a service provider of the group that was itself hit at the end of October.
- From 1 November (reported): according to the same Le Figaro piece, “information started circulating on X from 1 November.”
- By the morning of 4 November: crypto news outlets, including CoinDesk as Reuters notes, report that about $133 million was taken and name the bank as the suspected victim. Le Télégramme reports $133 million, or €118 million.
- 4 November, morning: “as soon as the attack was detected”, the bank informs the “competent and supervisory bodies” and suspends some transactions as a precaution. Its banking app is unavailable to customers for several hours, franceinfo reports. The bank files a complaint with the Paris prosecutor. “Almost all operations” resume during the morning.
- 4 November, 10:29: franceinfo reports a theft of “more than €100 million”, citing a source close to the case.
- 4 November, 13:00: first press release: the incident “is closed and under control”, customer assets are not affected, and customers should watch out for phishing.
- 4 November, 17:30: a second release in question-and-answer form (PDF) explains the bank’s own account, the service provider, Fortuneo and the amount.
- 4 November, evening: the Paris prosecutor’s office confirms to AFP that it opened an investigation that morning (AFP via Boursorama, 21:50).
- 5 November: the bank tells Reuters that around €100 million was stolen and that it informed the European Central Bank, French banking supervisors and prosecutors (Reuters via CNA).
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
What the bank confirmed, in its own words
The 17:30 release is the most detailed primary source so far. It answers seven questions. Translated from French, the key points are:
- What happened: “The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players, which then potentially allowed them to convert this money into cryptocurrency via specialised platforms. They therefore did not go through the accounts of customers of its federations or subsidiaries.”
- The way in: “No ‘entry’ was made through Fortuneo. The attackers went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly.”
- Human error? “No. This is a sophisticated attack from outside, which is now contained.” The bank says its security systems “identified the suspicious activity very quickly” and that it is working with judicial and police authorities to establish “the origin of the attack and its modus operandi”.
- The amount: asked whether €118 million ($133 million) was stolen: “We do not confirm this information and can simply validate the order of magnitude.” Part of the funds “could be blocked, and other actions are under way to recover them”. The amounts are “absolutely not of a nature to call into question the health and financial strength” of the group.
- Customers: “No impact.” The incident “has only caused a delayed execution of certain transfers”.
- Data: asked whether the phishing warning means customer data was exposed, the bank says such attacks are often followed by more phishing attempts, so it warned customers “as a precaution”. It does not say whether any data was taken. Reuters reported on 4 November that the bank did not answer that question.
How big is €100 million for this bank?
Every outlet has a different number, so it helps to line them up. Only one comes from the bank.
| Figure | Who says it | Status |
|---|---|---|
| About €100 million | The bank, to Reuters (5 Nov); AFP: “a provisional estimate” | Bank figure, provisional |
| €118 million ($133 million) | Le Télégramme; crypto news outlets | Bank: “order of magnitude”, not confirmed |
| At least €150 million | Le Figaro (4 Nov) | Not confirmed by anyone |
On 4 November Reuters also reported that the bank said the losses were lower than the $133 million first reported. That fits the later figure: €100 million is about $113 million.
To put it in proportion, here are the bank’s own half-year numbers (H1 2026 results): net profit of €230 million for the first six months of 2026, and prudential own funds of €11.2 billion at the end of June. On our own reading, €100 million is a little under half of a half-year’s profit, and under 1% of the bank’s own funds. That is a painful loss, but it is consistent with the bank’s statement that its solidity is not in question. The final loss will depend on how much is recovered.
Infographic 02 · How much, and how big
One bank figure, two reported ones
Only one number comes from the bank. Set against its own half-year results, the loss is painful but not a threat to its solidity, as the bank says.
Stolen from the bank’s own account, as the bank told Reuters on 5 November. AFP calls it a provisional estimate. Part of it has been blocked.
Bar length is proportional to the euro amount.
In proportion: the bank’s own numbers (H1 2026)
Sources: Reuters, 5 Nov · AFP, 4 Nov 21:50 · Arkéa Q&A, 4 Nov 17:30 · Le Figaro, 4 Nov (paywalled) · Arkéa H1 2026 results. Le Télégramme is paywalled; its figure is cited as reported by AFP.
Powered by Thorsten Meyer AI
Myth check: what the early posts got wrong
- “Hackers emptied customer accounts.” False, according to the bank. The money left from the bank’s own account. Customers saw delayed transfers, not missing money.
- “They got in through Fortuneo.” Denied. Early reports named the online bank as the entry point. The bank says the attackers came through a service provider’s platform.
- “Crypto was stolen from the bank.” False. The bank told Reuters the funds were not cryptocurrency. Euros were sent to other banks and then, the bank says, potentially converted into crypto on specialised platforms.
- “$133 million confirmed.” Partly true at best. The bank validates the order of magnitude, not the figure, and has since spoken of around €100 million.
The trail into crypto, and the chance of getting it back
The bank’s own description gives the path: its account, then “other banking players”, then crypto platforms. That is a classic laundering route. Every hop makes the money harder to stop.
Two of the platforms have spoken, as quoted by franceinfo from Cointelegraph. Kraken said it had restricted suspect accounts and is “working with the authorities to support recovery efforts”. Crypto.com said it had taken “appropriate action” to keep funds linked to the incident off its platform. Neither said how much it froze. We do not report on-chain data or crypto prices here.
Recovery is possible but rarely complete. The bank says part of the money “could be blocked”. How much depends on speed: funds that are still sitting at a regulated bank or exchange can be frozen with a court order or by the platform itself. Funds that have already been swapped and scattered are much harder to reach. The bank filed its complaint within hours, which is what gives investigators a chance.
Thefts from a mainstream bank’s own accounts are rare. Reuters recalls the best-known case: in 2016, attackers stole $81 million from Bangladesh’s central bank through its account at the Federal Reserve Bank of New York.
Who is behind it?
Nobody knows yet, and nobody has claimed the attack. The prosecutor is investigating an “attack on an automated data processing system by an organised gang”, in the words of the French criminal code. The case is with the Office anticybercriminalité (OFAC), France’s national anti-cybercrime police unit.
An expert quoted by Le Figaro suggests it could be a variant of “CEO fraud”, where criminals impersonate a manager to get an employee to approve a payment. That is speculation, and the bank says there was no human error on its side. No authority has attributed the attack to any group or state. We won’t either.
Is there an AI angle? Not so far. No source says AI was used in the attack. Reuters notes that regulators have stepped up warnings about cyberattacks on banks “particularly with the growth of AI”, and fraud-prevention vendors argue that AI agents could automate steps of such attacks. That is a general warning, not evidence from this case.
What this means for banks and companies
You don’t have to be a bank for these lessons to apply. Any company with a treasury account and outside service providers has the same weak spots. This is general information, not legal or professional security advice.
- Your own account is an attack surface. Customer payments usually get fraud scoring and limits. Treasury and internal transfers often get less, because “it’s our money”. Give them the same protection: payment limits, two-person approval, and a call-back on a known number before paying a new beneficiary.
- Map what each supplier can start, not just what it can read. The attackers reached the bank through a provider’s platform. Ask every provider that touches payments: which systems can you reach, which actions can you trigger, and which accounts do you use to do it?
- The responsibility stays with you. Under the EU’s Digital Operational Resilience Act (DORA), which has applied to banks and other financial firms since 17 January 2025, a financial entity using outside ICT services “shall, at all times, remain fully responsible” for its obligations (Regulation (EU) 2022/2554, Art. 28). Firms must keep a register of all such contracts and report major ICT incidents to their supervisor (Art. 19).
- Detect fast, stop fast. The bank says its systems flagged the activity quickly and that it froze transactions as a precaution. A kill switch for outgoing payments, tested before you need it, is worth more than a perfect forensic report afterwards.
- Prepare the recovery calls. Recovery depends on hours. Know in advance whom to call at correspondent banks, payment providers and large exchanges, and file a complaint immediately so that freezes have a legal basis.
- Talk early and correct rumours. Two statements in one day, the second answering the questions people actually asked, including a clear denial about Fortuneo. And a phishing warning before the scammers arrive.
What this means for customers
If you bank with Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest or Fortuneo, the bank says your deposits are not affected and the only impact was delayed transfers. Nothing in the official statements asks customers to do anything else. The real risk for you now is the second wave: scammers using this story.
- Expect fake calls and messages “about the attack”. The bank says it will never ask for your login, password, card number or an SMS validation code. If in doubt, call your adviser on a number you already know.
- No real adviser asks you to approve an operation in your app or to move money “to a safe account”. That is the classic fake-adviser fraud, as France’s official victim-support service explains (cybermalveillance.gouv.fr).
- If you were caught: block your card, contact your bank through its usual channels, change your online banking password, keep the evidence and file a complaint.
- Check that delayed transfers have gone through. If one hasn’t, ask your branch.
- For context only: in France, deposits are protected up to €100,000 per person and per bank by the deposit guarantee fund FGDR (garantiedesdepots.fr). That protection is for a bank failure, and nothing suggests one here. This is not financial advice.
The phishing risk is the same wherever you bank. Attacks that make headlines are always followed by scams that borrow them. A few nights ago it was supermarket freezers across Europe; this week it is a bank.
Infographic 03 · Lessons
Six checks for companies, and a phishing guard for customers
Any company with a treasury account and outside service providers has the same weak spots as this bank.
- Guard your own accountLimits, two-person approval and call-backs for treasury payments too, not only for customer payments
- Map what suppliers can startWhich systems, which actions, which accounts? Reading is not the same as paying
- Responsibility stays with youDORA Art. 28: the firm remains “fully responsible”; keep a register of ICT contracts
- A tested kill switchFreeze outgoing payments fast; the bank says it suspended transactions as a precaution
- Recovery contacts, in advanceCorrespondent banks, payment providers, exchanges; file a complaint at once
- Report and communicateDORA Art. 19: major ICT incidents go to the supervisor; correct rumours early
- Deposits not affected; only some transfers were delayed.
- Check that delayed transfers went through.
- If in doubt, call your adviser on a number you already know.
- No adviser asks you to approve an operation in your app.
- No adviser asks you to move money “to a safe account”.
- Caught out? Block your card, change your password, file a complaint.
Your bank will never ask for your password or an SMS code. Not by phone, not by text, not by e-mail.
General information, not legal, financial or professional security advice.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · DORA, Reg. (EU) 2022/2554 · cybermalveillance.gouv.fr.
Powered by Thorsten Meyer AI
What we don’t know
- Who the service provider is, and what kind of service it provides. The bank declined to name it.
- How the attackers got control of payments from the bank’s own account, and when the attack began.
- The final loss, and how much has been blocked or recovered so far.
- Whether any data was taken. The bank has not said.
- Who is behind it. There is no claim and no attribution.
The bank says it will communicate “as soon as new elements are available”. We will update this article when it does.
Sources
- Crédit Mutuel Arkéa, press release, 4 November 2026, 13:00: “Crédit Mutuel Arkéa annonce avoir été victime d’une attaque” (PDF, French).
- Crédit Mutuel Arkéa, press release, 4 November 2026, 17:30: “Informations complémentaires suite à l’attaque” (PDF, French).
- Crédit Mutuel Arkéa, H1 2026 results (PDF, French).
- AFP, 4 November 2026, 21:50, with the Paris prosecutor’s statement: via Boursorama.
- Reuters, 4 and 5 November 2026, via CNA: “counting losses” and “€100 million missing”.
- franceinfo, 4 November and 5 November 2026 (with AFP; quotes from Kraken and Crypto.com via Cointelegraph, and from Le Monde).
- Le Figaro, 4 November 2026: first report and “les coulisses de la cyberattaque” (paywalled; cited as “reported by”).
- Le Télégramme (paywalled; $133 million / €118 million figure as cited by AFP and Le Monde Informatique) and Le Monde, 4 November 2026 (paywalled).
- Solutions Numériques, 5 November 2026.
- Regulation (EU) 2022/2554 (DORA), Articles 19, 28 and 64.
- cybermalveillance.gouv.fr: fake bank adviser fraud. FGDR: deposit guarantee.
- Crypto news outlets (CoinDesk, The Block, Decrypt, Finextra) were used only as tips and are not cited for facts.
Images in this article are AI-generated illustrations. No real bank premises, people or logos are shown.
