Crédit Mutuel Arkéa confirms an attack that enabled fraudulent transfers, reportedly through a service provider

French banking group Crédit Mutuel Arkéa says an attack allowed fraudulent transactions before it suspended some flows and brought the incident under control. Customers’ assets are not affected, according to the bank; outside estimates put the theft at more than 133 million dollars.

What happened

On 4 November 2026, Crédit Mutuel Arkéa, the cooperative banking group based in Brest, announced that it had suffered an attack that allowed fraudulent transactions to be carried out. Once the attack was detected, the group informed the relevant and supervisory authorities and, as a precaution, temporarily suspended some transactions to block any further fraudulent movement. It describes the incident as closed and under control, with operations resuming gradually after checks and stronger security measures. According to the bank, customers’ assets are not affected: some transfers were only executed late. The amounts are still being assessed, but the group says they cannot threaten its financial soundness.

The bank has not published a figure. According to Numerama, an independent blockchain investigator reported withdrawals of more than 106 million dollars on 2 November, then raised the estimate to more than 133 million dollars (about 118 million euros) before naming Arkéa. According to The Record, the bank later said it could confirm the order of magnitude, not the exact amount.

How the attackers got in

According to The Record, which cites a second statement issued on Wednesday evening, the attackers went through the platform of one of the bank’s service providers, which was not named, to reach the group directly. They then used Arkéa’s own account to send transfers to other banks, from where the money may have been converted into cryptocurrency; part of it has been frozen. The bank reportedly rules out human error and is working with the judicial and police authorities.

What to do now

1. If you bank with the group (Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, Fortuneo…), expect phishing that exploits the news: never give your login, password, card number or SMS code, and call your adviser if in doubt.
2. List every provider with access to your systems or business platforms: named accounts, MFA, IP filtering, minimum rights and no permanent access.
3. Log and monitor provider sessions, with alerts on unusual hours, volumes or destinations.
4. Protect payment flows: dual approval above a threshold, checks on new beneficiaries and confirmation through a separate channel.

Our take

A provider’s platform connected to core systems is an entry point like any other, and often less closely watched. What limited the damage here, according to the bank, was fast detection and the ability to freeze transactions. Every company should know which third parties can act inside its systems, and be able to cut them off within minutes.

Sources

• Crédit Mutuel Arkéa — Crédit Mutuel Arkéa annonce avoir été victime d’une attaque
• The Record — French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
• Numerama — Piratage du Crédit Mutuel Arkéa : ce que l’on sait et qui est réellement concerné

How we choose, verify and write our analyses →