Crédit Mutuel Arkéa Hack: About €100 Million Stolen Through a Supplier Platform, What Is Confirmed and What to Check
Crédit Mutuel Arkéa says attackers reached it through a supplier's platform and moved money out of the bank's own account. What is confirmed, what is only claimed, and how to check your own supplier access.
Where France · Europe, Western Europe
On this page 7 sections
Crédit Mutuel Arkéa, a French banking group, says attackers got in through a platform run by one of its suppliers and used the bank's own account to send money to other banks, and AFP reports the bank's provisional estimate at about 100 million euros. If any outside company can reach the systems that move your money, this is the failure to test for now, whatever industry you are in.
Arkéa says customer money was not affected. The supplier has not been named and the method has not been published, so this post keeps what is confirmed apart from what is only claimed.
What happened at Crédit Mutuel Arkéa
Arkéa disclosed the attack on Wednesday, November 4, 2026, in a press release saying it had allowed fraudulent transactions. That release lists a balance sheet of 211.5 billion euros, and the group reported 5.64 million customers at the end of 2025.
A follow-up statement the same day gave the outline. The attackers went through a service provider's platform and reached Arkéa directly. They used Arkéa's own account to make transfers to other banks, which may have allowed the money to be converted into cryptocurrency. Arkéa said its online bank Fortuneo was not the entry point, and it rejected human error on its side, describing a sophisticated attack from outside.
The bank said it informed its supervisors and temporarily suspended some transactions as a precaution. Some customer transfers were delayed, and most operations have resumed.
Supplier platform breach: what is confirmed and what is claimed
| Point | Status | Who says so |
|---|---|---|
| About 100 million euros taken, amount still being evaluated | The bank's provisional estimate | AFP, November 5 |
| Entry through a supplier's platform | Stated by the bank, no technical detail published | Arkéa |
| Customer accounts not used, customer holdings not affected | Stated by the bank, no outside verification published | Arkéa |
| Some funds blocked or recovered | Stated, no amount given | Arkéa (blocked), and Daniel Baal, president of the Confédération Nationale du Crédit Mutuel, on France 5 (part recovered), per AFP, November 6 |
| Criminal investigation open | Confirmed by the Paris prosecutor's office to AFP, as an attack on a data processing system by an organised group | AFP, November 5 |
| 118 million euros | Press figure, not confirmed; Arkéa says it can validate only the order of magnitude | Le Télégramme, Arkéa |
| 133 million dollars or more | Claimed from exchange withdrawals | ZachXBT |
The blockchain investigator ZachXBT was first to flag the theft publicly. Posts on that channel describe a European entity losing more than 106 million dollars from exchange accounts on November 1, then raise the total and name Arkéa, saying the figure may be higher. Arkéa has not confirmed those numbers.
What is still not known
- The supplier. Arkéa has not named it or said what the platform does.
- The method. No account of how the supplier was compromised or how that led to the bank's account has been published.
- The final loss. Arkéa says the amount is still being assessed. It also says the sum does not threaten the group's financial health.
- How much has come back. Neither the bank nor Baal has given a figure.
- Who did it. AFP reported on November 5 that nobody had claimed the attack. On November 6, Baal said he could not say whether it came from France or abroad.
- Whether other banks are exposed. In that November 5 AFP report, Antoine Hautin, secretary general of the cybersecurity consultancy Almond, said it should be checked whether the supplier serves several banks and whether the method could be repeated elsewhere. That is an open question, not a finding.
- Customer data. Arkéa has warned about phishing but has not said customer data was taken.
Why a third-party vendor attack matters for a company network
By the bank's account, nobody needed to break into a customer account. A route through a trusted supplier led to an account that could send money. We do not know exactly how, so nobody should claim which control failed. The useful question for your business does not depend on that detail: what could someone do if they had the access your suppliers have today?
In most companies, the outside parties with a way in include the payroll provider, the invoice automation tool, the IT support firm, the accounting integration that talks to the bank, and the agency holding admin access to the website and payment gateway. Each of those accounts tends to be trusted, rarely reviewed and left in place after the project ends.
Vendor access security: what to do this week
These steps are our advice for any business. They do not describe how Arkéa was breached, because that has not been published.
| Do this | How to check |
|---|---|
| List every supplier that can reach payment systems | Pull users, API keys and service accounts from your bank portal, payroll, accounting and ERP tools |
| Remove what is no longer needed | Disable accounts for finished projects and former vendors, and rotate keys they held |
| Separate submitting from approving | Confirm no supplier account can both create a payment and release it |
| Control new payees | Require a hold and a callback to a known number before the first payment to any new account |
| Cap outgoing payments | Ask your bank what daily and per-payment limits it can enforce across every channel |
| Watch for changes | Send alerts on new payees, raised limits and new API keys to someone outside the supplier's reach |
| Rehearse the shutoff | Confirm who can cut a supplier off and suspend payments, and how fast, outside business hours |
| Tighten the contract | Require prompt breach notice, a named contact, and strong login protection on any account touching your systems |
| Warn staff about phishing | Arkéa told customers never to share logins, passwords, card numbers or SMS codes, and to confirm doubtful messages with their adviser |
Crédit Mutuel Arkéa hack questions people are asking
Was Crédit Mutuel Arkéa hacked?
Yes. The bank confirmed on November 4, 2026 that an attack allowed fraudulent transactions, and Paris prosecutors have opened an investigation.
How much money was stolen from Crédit Mutuel Arkéa?
The final amount is not known. AFP reported the bank's estimate at about 100 million euros, and Baal said more than 100 million. A figure of 118 million euros has circulated, which Arkéa has not confirmed.
Is my money safe at Crédit Mutuel Arkéa or Fortuneo?
Arkéa says customer accounts were not used and customer holdings were not affected, including at its subsidiaries. It says Fortuneo was not the entry point.
Was customer data stolen in the Arkéa attack?
Arkéa has not said so. It has warned that phishing attempts may follow, so treat unexpected calls, emails and texts about the attack with suspicion.
Which supplier was hacked?
Arkéa has not named the supplier, and no primary source we opened identifies it.
Who hacked Crédit Mutuel Arkéa?
No one has been publicly identified. France's anti-cybercrime office is investigating, according to AFP.
The bigger lesson
Your security boundary includes every company holding a way in. You cannot audit a supplier's internal defenses every week, but you can decide what their access is allowed to do, cap the damage if it is misused, and make sure someone notices quickly.
To review who can reach your systems and what they could do, see our security hardening work or request a tech quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Crédit Mutuel Arkéa press release, November 4; Crédit Mutuel Arkéa follow-up statement, November 4; Crédit Mutuel Arkéa 2025 results; AFP via The Jakarta Post, November 5; AFP via Bourse Direct, November 5; AFP via Bourse Direct, November 6; ZachXBT Telegram channel.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025....
Mirae Asset Securities Data Breach: About 39,000 People Exposed, Mostly Staff, and What Finance Firms Should Check This Week
Mirae Asset Securities says two attacks on November 4 and 5 exposed data on about 39,000 people, including 35,...
NBFC Cyberattack: Two Indian Lenders Report Over Rs 7 Crore Stolen Five Days Apart as CERT-In Warns of Payment API Attacks
Spandana Sphoorty and Keerthana Finserv reported Rs 7 crore-plus in unauthorised transfers five days apart. He...
