Crédit Mutuel Arkéa Hit by Cyberattack, with Unconfirmed Losses Estimated at €100 Million or More
A cyberattack moved money through the bank's own accounts. The bank has not confirmed the amount, and it says customer balances were not affected.
Updated November 7, 2026
By Jack AI Tech Brief
Editorial team
In short: Crédit Mutuel Arkéa, a French banking group, says a cyberattack led to fraudulent transfers from its own accounts. The bank has not confirmed any loss figure. Reports estimate the loss at more than €100 million, and an investigator estimated more than $133 million. The bank says customer accounts were not affected.
Key Facts
- Amount confirmed by the bank
- None; the bank can only validate the order of magnitude
- As of November 4, 2026
- Estimated amount allegedly taken, not confirmed by the bank
- €118 million ($132.44 million)
- As of November 5, 2026
- Customer accounts affected, per the bank
- Not accessed; balances unaffected
- As of November 4, 2026
What happened at Crédit Mutuel Arkéa?
Crédit Mutuel Arkéa said on 4 November 2026 that it had been the target of a cyberattack that allowed fraudulent transactions [1]. The bank says the attackers came through the platform of one of its service providers, and says the attack was not caused by human error [1][4].
The bank says customer accounts were not accessed, and that some transfers were delayed while it contained the incident [1][4].
The bank denies press reports that the attackers entered through its online bank Fortuneo [1][4]. ZachXBT, a blockchain investigator, first reported the case and said the attack ran over several days [4].
How much money is involved?
The bank has not confirmed an amount. It says it does not confirm the reported figures and can only validate the order of magnitude [1].
OCCRP reports an estimated €118 million, or $132.44 million, allegedly taken from the bank's corporate accounts [2]. The Record reports that the blockchain investigator ZachXBT estimated the theft at more than $133 million [4]. Le Monde reports figures in excess of €100 million [3]. The bank describes any conversion into cryptocurrency as potential rather than confirmed [1]. These are estimates, not confirmed losses.
Has any of the money been recovered?
Le Monde reports that the head of the Confédération Nationale du Crédit Mutuel said the bank had already recovered part of the missing money, without giving an amount [3]. The bank says some of the funds have been blocked, and that it is working to recover the rest [1][4].
What is still unknown?
The final loss has not been set. The bank says it is working with police and judicial authorities to determine the origin and method of the attack [1][4]. The identity of the service provider has not been named [4].
What should security teams take from this?
The attack reached the bank through a third-party platform, not through client accounts [1][4].
Our reading: a supplier's access to your systems is part of your own exposure. Review what suppliers can reach, and what they can move, even when they are not customer-facing.
Frequently Asked Questions
Has Crédit Mutuel Arkéa confirmed how much was stolen?
No. The bank says it does not confirm the reported figures and can only validate the order of magnitude. Estimates include more than €100 million, €118 million (OCCRP) and more than $133 million (ZachXBT, as reported by The Record).
Were customer accounts affected?
According to the bank, customer accounts were not accessed and balances were not affected, though some transfers were delayed.
How did the attackers get in?
The bank says they came through the platform of one of its service providers. It has not named the provider, and the investigation is ongoing.
Sources
- 1.
- 2.
- 3.
- 4.
Tags
Written with AI assistance and reviewed by a human editor before publication.How we produce this content.
