French banking group Crédit Mutuel Arkéa has confirmed that hackers infiltrated its computer systems and stole funds through fraudulent transactions, adding to a series of cybersecurity incidents affecting financial institutions worldwide.
- Hackers accessed Crédit Mutuel Arkéa through a third-party service provider and used the bank’s own account to transfer funds to other institutions, potentially converting some into cryptocurrency.
- The bank declined to confirm reports that €118 mn was stolen but acknowledged the approximate scale of the incident. Some funds have been blocked, and recovery efforts continue.
- Crédit Mutuel Arkéa said customer accounts and assets were unaffected, rejected claims that Fortuneo was the entry point and confirmed that most operations had resumed.
Crédit Mutuel Arkéa has disclosed further details of a cyberattack in which hackers accessed its systems through a third-party service provider and transferred funds from the banking group’s own account to other financial institutions.
The French lender confirmed that the incident did not involve unauthorized access to customer accounts, rejected reports linking the initial intrusion to its online banking subsidiary Fortuneo and said the attack had been contained.
In a statement issued on November 4, following an earlier announcement that afternoon, the bank also addressed reports that approximately €118 mn had been stolen. It declined to confirm the exact amount but acknowledged that the reported figure reflected the general scale of the incident.
How hackers accessed Crédit Mutuel Arkéa and transferred funds
According to Crédit Mutuel Arkéa, the attackers used an account belonging to the banking group to execute transactions to other banks.
Those transfers may subsequently have allowed the stolen money to be converted into cryptocurrency through specialized trading platforms. The bank did not confirm whether such conversions occurred.
The fraudulent transactions were conducted through Crédit Mutuel Arkéa’s own account rather than accounts belonging to customers of its regional banking federations or subsidiaries.
The group also disputed media reports suggesting that hackers had entered its systems through Fortuneo.
Crédit Mutuel Arkéa stated that Fortuneo was not the point of entry. Instead, the attackers accessed the banking group directly through the technology platform of one of its external service providers.
The bank characterized the incident as a sophisticated external cyberattack and explicitly rejected the suggestion that it resulted from human error within Crédit Mutuel Arkéa.
Crédit Mutuel Arkéa addresses reports of €118 mn cyber theft
Asked whether the attackers had stolen €118 mn ($133 mn), Crédit Mutuel Arkéa said it could not verify those specific figures.
The lender nevertheless acknowledged that the reported amount was broadly consistent with the scale of the financial loss under investigation.
Its teams are continuing to assess the total financial impact, including determining how much of the transferred money can be recovered.
Crédit Mutuel Arkéa confirmed that part of the funds involved in the fraudulent transactions had already been blocked. Additional recovery measures remain underway.
The bank said it was too early to establish a definitive loss figure, particularly while recovery efforts were continuing.
It also maintained that the amounts involved were not large enough to threaten its financial strength, solvency or overall stability.
Customer accounts unaffected as banking operations resume
Crédit Mutuel Arkéa emphasized that the attack had no financial consequences for customers of its banking network or Fortuneo.
The incident did not affect client assets, although certain transfer transactions experienced processing delays while the group implemented additional security controls.
Nearly all banking operations resumed during the morning of November 4, after Crédit Mutuel Arkéa and its subsidiaries completed the necessary verification procedures and introduced enhanced protective measures.
The bank said its security systems had identified suspicious activity quickly, enabling its teams to initiate established crisis-response procedures immediately. Those measures included temporarily suspending selected transactions as a precaution to secure banking operations and prevent further unauthorized transfers.
Crédit Mutuel Arkéa confirmed that the incident was under control and that the actions taken following detection had contained the attack.
The group has notified the relevant regulatory and supervisory authorities in accordance with established reporting procedures.
It is also cooperating with judicial and law enforcement authorities to establish the precise origin of the intrusion and determine how the attackers carried out the fraudulent transactions.
Bank warns customers about potential phishing attempts
Crédit Mutuel Arkéa separately addressed concerns that a warning about phishing in its earlier announcement might indicate that customer information had been compromised.
The bank explained that cyberattacks of this nature are frequently accompanied by an increase in fraudulent communications designed to obtain confidential information from customers.
Its warning was presented as a preventive security measure rather than confirmation that customer data had been exposed.
Crédit Mutuel Arkéa urged clients to remain particularly vigilant against phishing attempts and requests for sensitive banking information.
The bank continues to investigate the circumstances of the intrusion and assess the financial losses while pursuing recovery of the stolen funds. Its immediate operational response has focused on preventing additional fraudulent transactions, restoring normal services and maintaining customer protection.
