Crédit Mutuel Arkéa loses about 100 million euros to fraudulent transfers
French bank Crédit Mutuel Arkéa confirmed on 4 November 2026 that a cyberattack allowed fraudulent transactions. It says attackers sent roughly 100 million euros from the bank's own account, and that customers will bear no financial loss.
Key facts
- OrganisationCrédit Mutuel Arkéa, a banking group based in Brittany. Its brands include Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo.
- What happenedArkéa says attackers used the bank's own account to send transfers to other banks. Reports say the money was then turned into cryptocurrency.
- AmountArkéa gave a provisional estimate of about 100 million euros, per AFP. Le Télégramme reported 118 million euros, a figure Arkéa has not confirmed.
- CustomersArkéa says customer accounts were not the source of the funds and the incident has no financial consequence for customers. Some transfers were suspended and delayed.
- Cause or entry pointArkéa says it was a sophisticated outside attack, with no internal human error. It says the attackers went through the platform of one of its service providers.
- ClaimedNo group has claimed the attack.
- AuthoritiesArkéa says it is working with French authorities on the investigation and is trying to recover the money.
Timeline
- 3 Nov 2026Blockchain investigator ZachXBT flags large crypto movements, later estimated above 133 million dollars. FrenchWeb · Le Monde Informatique
- 4 Nov 2026Arkéa confirms a cyberattack that allowed fraudulent transactions. It says the incident is under control and suspends some transfers. Le Monde Informatique · FrenchWeb
- 5 Nov 2026Arkéa says the attackers went through a service provider's platform and used the bank's own account. It puts the loss at about 100 million euros. AFP via DH · Silicon Republic
- 5 Nov 2026Arkéa denies reports that the attack came through its online bank Fortuneo. Silicon Republic
Incident record
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedCrédit Mutuel Arkéa | 4 Nov 2026 | Finance | Intrusion | None | Confirmed. Arkéa disclosed a sophisticated outside attack that sent about 100 million euros from its own account to other banks and said customer assets were unaffected. | Silicon Republic✓ 7 Nov |
What to do
- Check your accounts in the official app and contact your adviser if an expected transfer has not arrived.
- Expect phishing that mentions the attack. Arkéa will not ask for passwords or security codes by phone, SMS or email.
- Forward suspicious SMS to 33700 and get help from cybermalveillance.gouv.fr.
- If you are the victim of a scam, call Info Escroqueries on 0 805 805 817 and file a complaint.
FAQ
How much was stolen from Crédit Mutuel Arkéa?
Arkéa gave a provisional estimate of about 100 million euros. Some media reported 118 million euros, which the bank has not confirmed.
Is my money at Arkéa, CMB or Fortuneo safe?
Arkéa says the funds came from the bank's own account and the incident has no financial consequence for customers. Some transfers were delayed.
How did the attackers get in?
Arkéa says they went through the platform of one of its service providers. It has not named the provider.
Related stories
- European supermarket fridges hacked in a single night Estonia, United Kingdom, Germany +5 · 3 Nov 2026
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0