🔍 Read the full analysis: €100 Million Left Arkéa’s Own Account: Here’s The Timeline on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said attackers used the French bank’s own account to make fraudulent transfers, and told Reuters on November 5 that about €100 million was stolen. The bank says customer accounts were not used and customer deposits are unaffected. Investigators are examining how attackers accessed a service provider’s platform; the provider and final amount recovered have not been disclosed.
French cooperative bank Crédit Mutuel Arkéa said attackers used the bank’s own account to make fraudulent transfers through a service provider’s platform, and told Reuters on November 5 that about €100 million was stolen. The bank says customer accounts were not used and customer deposits are unaffected; authorities are investigating how the attackers gained access.
In a statement issued on November 4, Arkéa said the attackers used its own account to carry out transactions to other banking institutions. The bank said the funds did not come from accounts held by customers of its federations or subsidiaries. It added that the transfers may have enabled the money to be converted into cryptocurrency through specialist platforms; that possible route is part of the bank’s description, not a confirmed account of where all the funds went.
On November 5, Arkéa told Reuters that around €100 million had been stolen. The previous day, the bank had declined to confirm a reported figure of $133 million, or about €118 million, saying it could validate only the order of magnitude. It has not given a final accounting. Some funds have been blocked, according to the source material, but the amount recovered or frozen is not known.
Arkéa said the attackers entered through the platform of an unnamed service provider and reached the bank directly. It said Fortuneo, its online banking subsidiary, was not the entry point and described the incident as an external attack rather than human error on its side. The bank said suspicious activity was identified quickly and that it was working with police and judicial authorities to establish the attack’s origin and method.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
A Bank’s Own Account Was Targeted
The incident differs from fraud that drains individual customer accounts: according to Arkéa, the attackers used a bank-owned account to send money out. That distinction matters for customers, who the bank says were not directly debited, and for financial institutions responsible for their own payment controls and supplier access.
The reported loss is substantial, but its ultimate impact cannot yet be measured from the available information. Arkéa has not disclosed how much of the money has been recovered, whether all transfers were stopped, or what losses the bank will ultimately record. The case also highlights a potential exposure beyond a bank’s own systems: a supplier platform able to initiate or facilitate transactions can become part of the security perimeter.
For customers, the bank’s warning about possible phishing is relevant. News of a bank incident can be used to make fraudulent messages appear credible. The source material advises customers not to share passwords or one-time SMS codes in response to unsolicited contact.
Products Worth Considering
Dell Pro 14 Plus P1425 14-Inch Portable Monitor
LG 27UP850K-W 27-inch 4K UHD IPS Monitor
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
The November 4 Disclosure Timeline
Arkéa has not said when the attack began. A report by Le Figaro, as described in the source material, said the incident started at a service provider that was itself hit in late October and that information began circulating on X from November 1. Those details are media reports, not dates confirmed by the bank.
By the morning of November 4, crypto news outlets were reporting a loss of about $133 million and identifying Arkéa as the suspected victim. That morning, the bank said it notified relevant and supervisory bodies once the attack was detected and suspended some transactions as a precaution. Franceinfo reported that the banking app was unavailable for several hours. Arkéa said almost all operations resumed during the morning.
At 1 p.m. on November 4, the bank issued a statement saying the incident was closed and under control, that customer assets were unaffected, and that customers should be alert to phishing. A more detailed question-and-answer statement followed at 5:30 p.m., explaining that the transfers used the bank’s own account and involved a service provider. The Paris prosecutor’s cybercrime section opened an investigation that morning, according to the prosecutor’s office as reported by AFP. The case was opened over suspected organised intrusion into a data-processing system and was assigned to France’s anti-cybercrime office.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, November 4 statement
The Amount and Access Route
The final financial loss remains undetermined. Arkéa has said that part of the money was blocked, but the available source material gives no figure for the amount frozen, recovered, or still missing. The bank also has not explained how the service provider’s platform was compromised, when the attack started, or which specific controls were bypassed.
The supplier has not been named, and the full transfer path and any cryptocurrency conversions have not been independently established in the material available here. Arkéa’s statement that the incident is contained is not the same as a final investigative finding. The scope of any data access, and whether the incident affected systems beyond the reported transactions, has not been specified.
Investigators Trace the Transfers
The Paris prosecutor’s cybercrime section is investigating, with France’s anti-cybercrime office leading the inquiry, according to the source material. Investigators are expected to establish how the attackers used the supplier platform, trace the transfers, and determine whether funds can be recovered. The bank says it is cooperating with judicial and police authorities.
Further updates from Arkéa or prosecutors may clarify the provider involved, the route taken by the money, and the amount ultimately recovered. Until those details are released, the €100 million figure should be treated as the bank’s estimate reported to Reuters, not a final audited loss. Arkéa has advised customers to be alert to phishing attempts that may exploit the incident.
Key Questions
Were customer accounts used in the transfers?
Arkéa says no. It said attackers used the bank’s own account and did not go through customer accounts at its federations or subsidiaries. The bank also said customer deposits were unaffected.
How much money was stolen?
Arkéa told Reuters on November 5 that around €100 million was stolen. The bank had earlier declined to confirm a reported €118 million figure. The final loss and the amount recovered or blocked have not been disclosed.
How did the attackers get access?
The bank said the attackers reached it through the platform of an unnamed service provider. It has not publicly described how that platform was compromised. Arkéa said Fortuneo was not the entry point.
Are customers’ deposits affected?
Arkéa said customer assets and deposits were not affected by the incident. Customers should still be cautious of messages or calls using the attack as a pretext to request account details, passwords, or SMS codes.
What happens next?
The Paris prosecutor’s cybercrime section has opened an investigation, led by France’s anti-cybercrime office. Investigators are examining the intrusion and transfers; the provider’s identity, the final loss, and any further recovery of funds remain unknown.
Source: ThorstenMeyerAI.com
