Crédit Mutuel Arkéa Cyberattack: Attackers Came In Through a Vendor and Took Over 100 Million Euros, What Is Confirmed and What to Check
Crédit Mutuel Arkéa says attackers came through a service provider's platform and used the bank's own account to move money. Over 100 million euros is reported stolen. Here is what is confirmed and what is not.
Where France · Europe, Western Europe
On this page 7 sections
Crédit Mutuel Arkéa, a French banking group, confirmed on Wednesday, November 4, 2026, that a cyberattack let criminals carry out fraudulent transactions, and it says they came in through a service provider's platform. The president of the wider Crédit Mutuel confederation has since said more than 100 million euros was taken, which makes this a warning for any company whose money can be moved through a vendor's system.
You may see this described as a theft the bank failed to notice. No source we opened establishes that. The bank has not said when it detected the attack, so that question stays open here.
What happened in the Crédit Mutuel Arkéa cyberattack
In its first statement, dated November 4, the bank said an attack had enabled fraudulent transactions, that some transactions were suspended as a precaution, and that the incident was under control.
A follow-up the same day added the key detail. The attackers used Crédit Mutuel Arkéa's own account to send transfers to other banks, which the bank says may have let them convert the money into cryptocurrency. They did not go through client accounts at its federations or subsidiaries.
The bank also said no "entry" was made through Fortuneo, its online bank. It says the attackers reached it directly through the platform of a service provider, which it did not name. It rejects human error as the cause and calls this a sophisticated attack from outside.
On Friday, November 6, Daniel Baal, president of the Confédération Nationale du Crédit Mutuel, said on France 5 that more than 100 million euros was stolen and that part of it has been recovered. He did not say how much.
Crédit Mutuel Arkéa hack: what is confirmed and what is claimed
| Point | Status | Who says so |
|---|---|---|
| An attack enabled fraudulent transactions | Confirmed | The bank |
| Entry through a service provider's platform, not Fortuneo | Stated, provider not named | The bank |
| The bank's own account sent transfers to other banks | Stated | The bank |
| No financial consequence for customers | Stated, not independently verified | The bank |
| More than 100 million euros stolen | Stated | Daniel Baal, reported by AFP |
| 118 million euros (133 million dollars) | Reported. The bank does not confirm it and says it can only validate the "order of magnitude" | Le Télégramme, ZachXBT |
| Part of the money blocked or recovered | Stated, no amount given | The bank, Daniel Baal |
| The theft began November 1 and ran for days | Claimed | ZachXBT |
| Who did it | Unknown | ZachXBT says not Lazarus Group. Baal could not say whether French or foreign |
Did the bank detect the attack late?
That question cannot be answered yet. Blockchain investigator ZachXBT posted that "an EU entity" was suspected of losing more than $106 million from multiple centralized exchange accounts on November 1, a Sunday. The Block reported that on November 3 he named Crédit Mutuel Arkéa as the alleged victim and raised his estimate to more than $133 million. The bank's first public statement is dated November 4.
That is about three days between the claimed start and public confirmation, but public confirmation is not detection. An organization can spot an attack, act on it and brief regulators before it says anything publicly. Crédit Mutuel Arkéa says it acted under existing crisis procedures and informed its regulators and supervisors. It has not published a timeline.
ZachXBT goes further. He claims some exchange withdrawals happened after his first post, and that the lack of proper disclosure let more than $30 million be laundered that EU law enforcement could have frozen. Those are his allegations. The bank has not confirmed them, and none of the official statements we opened support them.
Why a bank cyberattack matters for your company
The way in was a supplier. Your payroll service, accounting platform, payment gateway or remote IT tool may hold the same kind of access. The provider here is unnamed, and experts quoted by AFP say the key question is whether it also serves other banks.
The money left the organization's own account. Many controls are built to catch fraud against customers. Your own operating and payment accounts need the same scrutiny.
Speed decides what comes back. The bank says part of the funds was blocked. ZachXBT describes money being swapped and moved across chains, and experts told AFP that tracing crypto is difficult. Once money is converted and moved, your options narrow.
Attackers do not keep office hours. If the claimed Sunday start is right, a payment system nobody watches on weekends is an obvious gap.
Payment fraud detection checklist: what to do this week
The bank has not published technical details, so these are our recommendations based on the route it described.
| Do this | How to check |
|---|---|
| List every vendor that can start, approve or change a payment | Review bank portal users, API keys and connected apps. Remove what nobody can explain |
| Require a second approval outside the vendor's platform | Test it: can one login at one vendor send money alone? |
| Set limits and alerts on outgoing transfers | Confirm alerts fire for new payees and unusual amounts |
| Cover nights and weekends | Name who receives alerts on a Sunday and how they respond |
| Keep vendor and bank portal logs somewhere monitored | Pull last week's logs. If nobody can, fix that first |
| Write down who to call | Keep your bank's fraud number offline. US businesses can file at IC3, which says it may in some cases freeze stolen funds |
| Ask key vendors how they would tell you about a breach | Get a named contact and a notification commitment in writing |
| If you bank with Crédit Mutuel Arkéa or Fortuneo | The bank warns of possible phishing. If unsure about a message, contact your adviser directly |
Crédit Mutuel Arkéa hack questions people are asking
Was Crédit Mutuel Arkéa hacked?
Yes. The bank confirmed on November 4, 2026, that an attack enabled fraudulent transactions.
How much money was stolen from Crédit Mutuel Arkéa?
The final amount is not known. Daniel Baal said more than 100 million euros. Le Télégramme reported 118 million euros, and the bank says it can only validate the order of magnitude.
Was Fortuneo hacked?
The bank says the attackers did not enter through Fortuneo and that client accounts at its subsidiaries were not used.
Is customer money safe?
The bank says customers face no financial consequence and that the main effect was delayed transfers, most of which resumed on the morning of November 4.
Was customer data stolen?
The bank has not reported that. It explains its phishing warning as a precaution, because phishing often rises after attacks like this.
Who is behind the attack?
Nobody has been publicly identified. The investigation is with France's Office anticybercriminalité, known as OFAC, which is not the US Treasury office with the same initials.
Could the same attack hit other banks?
Nobody has said. The provider has not been named, so it is not known whether it serves others.
The bigger lesson
Your security is partly decided by the vendors you connect to your money. Baal said this affair "doit servir de leçon", meaning it should serve as a lesson. For most companies, that lesson is simple: know who can move your money, make sure one compromised login cannot do it alone, and decide now who responds when an alert fires on a Sunday.
If you want your payment and vendor access reviewed, see our security hardening service or request a quote.
Get security alerts by email, with the free checklist, at /security-alerts.
Sources: Crédit Mutuel Arkéa statement; Crédit Mutuel Arkéa follow-up; ZachXBT investigations; The Block; France 24; AFP via DH; FBI IC3.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025....
Mirae Asset Securities Data Breach: About 39,000 People Exposed, Mostly Staff, and What Finance Firms Should Check This Week
Mirae Asset Securities says two attacks on November 4 and 5 exposed data on about 39,000 people, including 35,...
NBFC Cyberattack: Two Indian Lenders Report Over Rs 7 Crore Stolen Five Days Apart as CERT-In Warns of Payment API Attacks
Spandana Sphoorty and Keerthana Finserv reported Rs 7 crore-plus in unauthorised transfers five days apart. He...
