Crédit Mutuel Arkéa confirms fraud-linked cyberattack but not reported €118m loss

Crédit Mutuel Arkéa confirmed on 4 November 2026 that it had been the target of a cyberattack that enabled fraudulent transactions. The French banking group suspended some transactions as a precaution, notified authorities and supervisory bodies, and said the incident had been contained. Customer assets were unaffected, it said, and almost all operations resumed during the morning after enhanced security measures.

Those assurances address immediate customer concerns but leave the central questions open. The bank has not confirmed the reported €118 million loss, has not named the service provider whose platform it says the attackers used, and has not established who was responsible, how the intrusion was carried out or whether customer data was accessed. Its statements describe a serious fraud incident, not a confirmed breach involving customer accounts.

Containment and customer impact

In its first statement on 4 November, the bank said it had contacted the relevant authorities and supervisory bodies and taken the precautionary decision to suspend certain transactions to protect operations and prevent further fraudulent payments. Operations resumed gradually after checks and enhanced security measures. The amount affected was still being assessed, it said, but would not threaten the group’s financial strength or soundness.

Reuters reported that the bank did not give further details about the fraudulent transactions. The public record therefore combines a clear account of the bank’s response with much less detail about how the fraud was carried out. The bank has confirmed that fraudulent transactions occurred, but it has not set out the technical steps that made them possible.

The disputed loss

In a later update the same day, the bank said the attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banks, which may then have allowed them to convert the money into cryptocurrency through specialised platforms. It said the attackers did not go through customer accounts and that the incident had not caused customers financial loss.

The assurance concerns customer deposits and accounts. It is not a technical explanation of how the intrusion worked, and it does not resolve whether any other systems or data were affected. The wording about cryptocurrency also describes a possible conversion after money left the bank, not a confirmed final destination.

Le Télégramme reported a loss of €118 million, equivalent to $133 million, according to RTBF Actus. VRT NWS reported that the group lost more than €100 million. The bank said it did not confirm the €118 million figure and could validate only the order of magnitude. It said part of the funds concerned had been blocked, that other recovery actions were under way and that it was too early to give a final total.

Those statements make the reported figure a press estimate that the bank partly acknowledges in scale, not a confirmed net loss. Funds affected are not the same as funds ultimately lost, particularly when some have been blocked and recovery efforts are continuing.

A contested entry route

Press reports suggested the attackers entered through Fortuneo. Crédit Mutuel Arkéa denied that account. It said there was no entry through Fortuneo and that the attackers went through the platform of one of its service providers before reaching the bank directly. The provider was not named.

The bank also rejected the suggestion that human error at Arkéa caused the incident. It described a sophisticated attack from outside and said its teams were working with judicial and law enforcement authorities to establish where the attack came from and how it was conducted. Those are company statements. The initial access mechanism, the service provider’s identity and the attacker’s identity remain unknown.

What customers should understand

The bank said the incident had no impact on customer assets and caused only delays in some transfers. It warned that phishing attempts were possible and told customers never to share personal or banking information such as a login ID, password, bank card number or SMS validation code, and to contact their adviser if in doubt.

The later update said an increase in phishing attempts is common in attacks of this nature and that the warning was intended as a preventive measure. The bank did not state that customer data had been compromised. The warning is therefore a reason for caution, not evidence of a data breach. The question of whether any customer data was accessed remains unanswered in the public statements.

Reuters described Crédit Mutuel Arkéa as comprising Crédit Mutuel federations in Brittany and south-west France plus about 40 subsidiaries, with 5.8 million clients and €211.5 billion in assets. The group is the parent of Belgian online bank Keytrade Bank, which referred to the parent group’s statement and declined to comment further, according to VRT NWS.

NHK WORLD-JAPAN reported the bank incident alongside separate cyberattacks that affected blood product storage in France and supermarket refrigeration in Europe. The French Blood Establishment said monitoring detected an abnormality, products were relocated and there was no damage. No shared actor or causal link with the Arkéa attack has been established, and the cases should not be treated as one campaign.

The most useful distinction for customers is between money moved through the bank’s own account, which the bank has acknowledged, and loss of customer deposits or personal data, which the bank’s statements do not establish. The bank’s assurance that customers lost no money is important, but it is narrower than a finding that no system or data were affected.

The unresolved items are specific: the final net loss after recovery, the provider’s identity and the route taken through its platform, and the actor behind the attack. Until those are established, the €118 million figure and the precise route into the bank remain a reported claim and a company description, not settled findings.

Phishing warnings tend to arrive mid-incident, when the facts are still thin, and telling a precaution apart from a confirmed compromise is part of reading them well. Here the bank asked customers to guard their login IDs, card details and SMS codes while stating that no customer data had been shown to be accessed, two messages worth holding separately. Cybersecurity fundamentals is where that habit begins: separating protective advice, an acknowledgement and an established finding, and keeping each one labelled as what it is. The Hack Academy’s online cybersecurity training programme lists cybersecurity fundamentals among its subject areas, with self-paced learning and practical exercises alongside the theory. The Hack Academy’s online cybersecurity training programme It will not settle the Arkéa figures, but it makes the next warning easier to weigh.