🔍 Read the full analysis: What The Hour-by-Hour Timeline Reveals About Arkéa’s €100 Million Hack on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on November 4 that attackers used the bank’s own account to make fraudulent transfers through a service provider, not customer accounts. On November 5, it told Reuters that around €100 million was stolen; the precise loss, attack start time and recovery amount remain unclear.
Crédit Mutuel Arkéa said attackers used the French bank’s own account to make fraudulent transfers through a service provider, and told Reuters on November 5 that around €100 million was stolen. The bank says customer accounts were not used and deposits are unaffected; the precise loss and how much money can be recovered have not been established publicly.
The bank’s November 4 statements establish the core of the incident: attackers made transfers from an account belonging to Crédit Mutuel Arkéa to other banking institutions. The bank said the attackers may then have tried to convert the money into cryptocurrency through specialist platforms. That possible conversion route is part of the bank’s account of events; it has not published a transaction-by-transaction reconstruction.
Arkéa said the attack came through a service provider’s platform, which gave attackers a path to the bank. It has not named the provider or described the access method. The bank said its online subsidiary Fortuneo was not the entry point and characterized the incident as an external attack rather than human error by its own staff.
On the morning of November 4, the bank said it notified relevant authorities and supervisors and suspended some transactions as a precaution. Franceinfo reported that its banking app was unavailable for several hours. The bank said almost all operations resumed that morning. On November 5, it confirmed to Reuters that approximately €100 million had been stolen. It had earlier declined to confirm a reported figure of $133 million, equivalent to about €118 million, saying it would validate only the order of magnitude. The bank said some funds had been blocked, but has not disclosed the final net loss.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why the Bank’s Own Account Matters
The incident differs from attacks in which criminals take money directly from individual customers. Arkéa says the funds came from the bank’s own account, while customer accounts were not involved and customer deposits were not affected. That distinction matters to customers assessing immediate financial exposure, although it does not remove the possibility of service disruption or follow-on fraud attempts.
For financial institutions and other businesses, the stated route through a supplier points to a broader operational risk: a third party’s platform may have access to systems or processes that can initiate high-value transactions. The case does not yet establish precisely how that access was abused, so it cannot by itself show which safeguards failed. It does show why organizations must account for supplier access when reviewing payment controls and incident response.
The bank warned customers to be alert to phishing. Criminals may exploit news of a major incident to pose as bank staff and request passwords or one-time codes. Arkéa’s statements say customer accounts were not the source of the stolen money; any message asking customers for credentials should be treated with caution and verified through official channels.
Popular right now
Samsung 65-Inch The Frame Pro Neo QLED 4K TV (2026) Bundle with Modern Brown Bezel, HDMI Cables, and Home Theater Guide
Dyson Cyclone V10 Origin Cordless Vacuum
KitchenAid 5.5-Qt Bowl-Lift Stand Mixer, Porcelain White (KSM55SXXX)
As an affiliate, we earn on qualifying purchases.
How the Public Timeline Developed
The bank has not said when the intrusion began. A reported chronology therefore needs to distinguish its statements from media accounts. Le Figaro reported that the attack began at a supplier affected in late October and that information circulated on X from November 1. Those dates have not been confirmed by Arkéa, and the bank has not published a precise start time.
By the morning of November 4, crypto news outlets were reporting a suspected loss of about $133 million, Reuters later noted. At 10:29 a.m. that day, franceinfo reported more than €100 million had been taken, citing a source close to the case. These early figures were reports, not confirmation by the bank.
Arkéa issued a statement at 1 p.m. on November 4, saying the incident was contained and customer assets were unaffected. A more detailed question-and-answer statement at 5:30 p.m. described the bank account and service-provider route. The Paris prosecutor’s office confirmed that day that its cybercrime section had opened an investigation that morning for suspected organized intrusion into a data-processing system. The investigation is being led by France’s anti-cybercrime office. The bank told Reuters on November 5 that it had informed the European Central Bank, French banking supervisors and prosecutors.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
What the Timeline Cannot Establish Yet
The published timestamps do not reveal when the attackers first gained access, how long they operated, or when the fraudulent transfers began. The late-October start and November 1 circulation of information were reported by Le Figaro, not confirmed by the bank. The sequence also does not establish how quickly each transfer was detected or which controls stopped subsequent activity.
The provider’s identity, the technical vulnerability or access method, the total amount moved, and the amount ultimately recovered remain undisclosed. Arkéa has said some money was blocked, but there is no final figure for funds returned or losses retained. The reported possibility that money was converted into cryptocurrency has not been detailed publicly. Investigators have not released findings establishing responsibility or a complete account of the attack.
Investigation and Recovery Updates
France’s anti-cybercrime office is investigating under the authority of the Paris prosecutor’s cybercrime section. The bank says it is working with judicial and police authorities to determine the attack’s origin and method. Further updates from the bank, investigators or banking supervisors may clarify the provider’s role, the transaction trail and the amount recovered.
For now, customers can monitor official bank communications and check account activity, while avoiding links or calls that request passwords or SMS verification codes. Businesses should review which supplier platforms can initiate or approve payments and whether high-value transfers require independent checks. These steps address general fraud risks; they do not establish what controls were or were not in place at Arkéa.
Key Questions
Were Crédit Mutuel Arkéa customers’ accounts hacked?
The bank says attackers used Crédit Mutuel Arkéa’s own account, not accounts held by customers of its federations or subsidiaries. It has said customer deposits were unaffected.
How much money was stolen?
Arkéa told Reuters on November 5 that around €100 million was stolen. The bank had not confirmed the earlier reported figure of €118 million, and the final loss remains unknown.
How did the attackers get in?
The bank says they came through a service provider’s platform. It has not named the provider or disclosed the specific access method. Arkéa says Fortuneo was not the entry point.
Can the stolen money be recovered?
The bank has said that some funds were blocked, but it has not provided a final recovery total. Whether additional money can be returned remains unclear.
What should customers do now?
Follow notices through the bank’s official channels and be alert to messages claiming to be about the incident. Do not share passwords or SMS codes in response to calls, texts or emails; verify unexpected requests independently.
Source: ThorstenMeyerAI.com
