Crédit Mutuel Arkéa counts a roughly €100 million cyberattack loss
The Breton banking group says customer accounts were not compromised after attackers moved money through a third-party platform, while recovery work continues.
Crédit Mutuel Arkéa says roughly €100 million remains missing after a cyberattack used the bank's own account on a third-party platform. The Brittany-based group said the intrusion did not enter customer accounts and that no customer funds were affected. Reuters reported on 5 November that prosecutors were investigating while the bank worked to recover the money.
The amount needs careful wording. Initial reports referred to a larger dollar figure, which the bank disputed, before later information put the missing sum at around €100 million. Some funds have been frozen and recovery work is under way, but the final net loss has not been established publicly. The purchase or transfer path has also not been described in enough detail for outsiders to audit it.
A third-party route under scrutiny
The bank says attackers compromised a service provider and then used credentials or access linked to an Arkéa account on that platform. It has not named the provider. Arkéa also said Fortuneo, its online bank, was not the point of entry. Those statements narrow the known route but leave important technical and governance questions for investigators.
Le Monde reported that the funds were converted into cryptocurrency after the transfer and described the incident as unusually large for a direct theft from a mainstream European bank. That reporting is independent of the bank's statement, although the exact recovery prospects remain uncertain. Converting funds can complicate tracing, but it does not make recovery automatically impossible.
Customer accounts and bank capital
For customers, the distinction between the bank's own capital and deposits matters. Arkéa says online services and account balances were protected, although some transfers were delayed while systems were secured. Customers should still rely on official account notices and normal fraud precautions rather than respond to messages that exploit the publicity around the attack.
The case also shows why financial institutions monitor suppliers as part of their own security perimeter. A protected core system can still face exposure through an external platform with legitimate access. The relevant questions now include authentication controls, transfer limits, monitoring alerts and how quickly the unusual movement was detected.
The final loss is not yet known
This is therefore both a theft investigation and a test of operational resilience. The confirmed scale is around €100 million missing, not a final loss figure. The bank's assurance that customers were unaffected is important, but the investigation and recovery process will determine how much money returns and whether control failures require wider changes.
Sources & context
Reporting and reference material used for this article. Context sources do not independently confirm every news claim.
- Crédit Mutuel Arkéa ↗Primary company update, published 4 November 2026: third-party entry route, customer-account status, containment and recovery work.
- Reuters via Euronext ↗Independent reporting, published 5 November 2026: roughly €100 million missing, prosecutor involvement and the continuing recovery effort.
- Le Monde ↗Independent business and security reporting, updated 6 November 2026: third-party compromise, cryptocurrency conversion and European banking context.
Written for WHIF from the linked material. This article does not claim on-the-ground reporting. Our editorial standards.