🔍 Read the full analysis: What We Know About The Money From Arkéa’s Own Account on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Crédit Mutuel Arkéa says attackers used the bank’s own account, reached through a service provider’s platform, to make fraudulent transfers. On November 5, the bank told Reuters that around €100 million was stolen; some funds have been blocked, but the final loss and recovery amount remain unknown. The bank says customer accounts and deposits were not affected.
Crédit Mutuel Arkéa said attackers used the French bank’s own account to make fraudulent transfers, and on November 5 told Reuters that around €100 million was stolen. The bank says the attackers reached it through a service provider’s platform, not through customer accounts, and that customer deposits were not affected. Some money has been blocked, but the total loss and amount that may be recovered have not been confirmed.
In a question-and-answer statement issued on November 4, Arkéa said the attackers used the bank’s own account to send transactions to other banking institutions. The bank said those transfers could then have allowed funds to be converted into cryptocurrency through specialist platforms. It did not say that cryptocurrency conversion had been confirmed in every case, or identify the receiving institutions.
The bank said the attackers accessed its systems through a service provider’s platform, which gave them a route to Arkéa directly. It has not named that provider or described the specific weakness that was exploited. Arkéa said Fortuneo, its online banking subsidiary, was not the entry point, and rejected human error on its own part as the cause.
On November 5, Arkéa told Reuters that around €100 million had been stolen. The figure is the bank’s estimate reported by Reuters, not a final accounting. Earlier reports cited €118 million, equivalent to about $133 million, but Arkéa had declined to confirm that precise figure and said it could validate only the order of magnitude. The bank says some funds have been blocked; it has not disclosed how much or whether all blocked money can be returned.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The incident differs from fraud that targets individual customers: according to Arkéa, the money came from the bank’s own account, not from customers’ current accounts or savings. That distinction matters for customers concerned about direct losses. The bank says their deposits were not affected, although the attack disrupted some services while the incident was being handled.
For financial institutions and other businesses, the described route points to a broader security concern: third-party platforms can provide access to payment processes. A supplier may not hold customer deposits, yet a connection to a bank’s operations can still become a route for moving significant sums. Arkéa has not published enough technical detail to determine precisely how the supplier platform was used or what safeguards failed.
The case also remains a live test of whether funds sent through other institutions or converted into cryptocurrency can be traced and recovered. Arkéa’s statement that some money has been blocked is an interim development, not confirmation of a full recovery. The amount ultimately lost is still uncertain.
Popular right now
Bose QuietComfort Wireless Noise Cancelling Headphones, Black
Ninja Foodi DZ201 8-Quart DualZone 6-in-1 Air Fryer
Shark HydroVac MessMaster Wet/Dry Vacuum & Mop Combo (AW261)
As an affiliate, we earn on qualifying purchases.
How the Attack Came to Light
Arkéa said it detected suspicious activity and, on the morning of November 4, notified relevant authorities and supervisory bodies. The bank said it suspended some transactions as a precaution. Its services were disrupted for several hours, according to reporting by franceinfo, while the bank said almost all operations resumed that morning.
In its first public statement on November 4, the bank described the incident as closed and under control and said customer assets were unaffected. A more detailed statement later that day explained that the transfers came from Arkéa’s own account and that a service provider’s platform was involved. On November 5, it gave Reuters the estimate of around €100 million stolen.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data-processing system, according to the supplied reporting. France’s anti-cybercrime office is leading the inquiry. Arkéa said it was working with police and judicial authorities to establish how the attack began and how it was carried out.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, statement issued November 4
The Final Loss Is Not Yet Known
The bank’s estimate of around €100 million does not establish the final amount stolen. Arkéa previously declined to confirm the reported €118 million figure, and the supplied information does not provide a final reconciliation of transactions. The bank has not said how much of the money has been blocked, how much may be recoverable, or whether any funds have been returned.
Several details about the attack remain undisclosed or under investigation. Arkéa has not named the service provider, specified when the intrusion began, or publicly set out the technical steps used to initiate the transfers. The bank says it is working with authorities to establish the attack’s origin and method. Those findings have not yet been reported.
Arkéa says customer accounts and deposits were not affected, but the available statements do not provide a complete account of the temporary service disruption or list every transaction suspended. Reports of cryptocurrency conversion describe a possible use of the transferred money; the bank’s wording does not confirm the extent to which conversion occurred.
Investigators Trace the Transfers
The Paris prosecutor’s investigation is expected to establish how the attackers accessed payment processes, which institutions received transfers, and whether money moved into cryptocurrency platforms. No public timetable or next announcement date is provided in the source material. Further findings from investigators or the bank may clarify the provider’s role and the total amount lost.
Arkéa will also need to determine how much of the money that has been blocked can be recovered and report a final loss figure. For now, the bank’s statements support a narrower conclusion: its own account was used, the attack route involved a service provider’s platform, and customer deposits were not affected, according to Arkéa.
Customers should be alert to messages that exploit news of the incident. The bank has warned about phishing. Do not provide passwords or SMS verification codes in response to a call, text, or email claiming to be about the attack; verify account-related messages through official bank channels.
Key Questions
Where did the money come from?
Arkéa says attackers used the bank’s own account to make transfers. The bank says customer accounts were not used and customer deposits were not affected.
How much was stolen?
On November 5, Arkéa told Reuters that around €100 million was stolen. The bank has not published a final figure; it earlier declined to confirm a reported €118 million estimate.
How did the attackers reach the bank?
Arkéa says they came through a service provider’s platform. The bank has not identified the provider or publicly described the technical method. It says Fortuneo was not the entry point.
Can the money be recovered?
Arkéa says some funds have been blocked, but it has not disclosed the amount or confirmed how much can be returned. The final recovery total remains unknown.
Are Arkéa customers’ deposits affected?
The bank says customer accounts and deposits were not affected. Customers should still be cautious of phishing messages and should not share passwords or SMS codes with anyone contacting them about the incident.
Source: ThorstenMeyerAI.com
