Written on the evening of 6 November 2026, from the bank’s statements and AFP reports. The investigation is ongoing: some points below will change. Sources are listed at the end.
What is confirmed
- The announcement: on the evening of Wednesday 4 November 2026, Crédit Mutuel Arkéa (headquartered near Brest, covering the Brittany and South-West federations) announced it had suffered a cyberattack that enabled fraudulent transactions. The Paris prosecutor’s office had received its complaint that morning.
- The amount: the bank gives a provisional estimate “in the order of €100 million”. On Friday 6 November, Daniel Baal, president of the national Crédit Mutuel confederation, confirmed on France 5 an order of magnitude above €100 million, and said the bank had “already” recovered “part” of it, without a figure.
- The way in, according to the bank: “the attackers went through the platform of one of our suppliers”. The supplier has not been named.
- The mechanism, according to the bank: the attackers used one of the bank’s own accounts to send transfers to other institutions, then converted the money into cryptocurrency on specialised platforms.
- Customers, according to the bank: accounts of customers of its federations and subsidiaries were not used, balances are unaffected, and no theft of customer data has been reported. Daniel Baal repeated that “no individual’s account was affected”. Visible effect: some transfers were delayed, and operations were temporarily suspended, most resuming the next morning.
- Fortuneo (online subsidiary): the bank says “no entry was made through Fortuneo”, contrary to some press reports.
- The investigation: opened by the cybercrime section of the Paris prosecutor’s office for organised attacks on an automated data processing system, led by the French anti-cybercrime office (OFAC). The bank says it informed the relevant authorities and supervisors.
Reported, not confirmed
- €118 million ($133 million), a figure published by Le Télégramme. The bank does not confirm it, but validates the “order of magnitude”.
- According to experts quoted by AFP, the operation may have lasted several hours or even days. That is a hypothesis, not an established fact.
What we don’t know
- Who: no one has claimed the attack. Daniel Baal could not say whether it came from France or abroad.
- Which supplier, what service it provided, and whether it works for other banks. That is the key question for the rest of the sector: if the same door exists elsewhere, the risk is not specific to Arkéa.
- How the bank’s account was able to issue these transfers: stolen credentials, a flaw in the platform, abuse of legitimate access. Nothing has been published.
- How much has been recovered.
Any more precise claim in the coming days (a group, a country, a supplier) deserves to be checked at the source before being repeated.
Why customers should still be careful
No customer data breach has been announced. The risk is elsewhere: a high-profile banking story is a gift to scammers. They need no stolen data to mass-send a text saying “Following the cyberattack, your account is suspended, confirm your identity”, or to phone you pretending to be the fraud department. The bank itself has warned customers about phishing.
What to do (customers of this bank or any other)
- Do not click any link in a text or email about the cyberattack, a blocked account or a “security update”. Open the bank’s app or type its address yourself.
- Hang up if someone calls on behalf of the bank, the “fraud team” or the police to “secure” your money. A bank never asks for a code received by text, to approve a transaction in the app during a call, or to transfer money to a “safe account”. Call back yourself on your adviser’s number or the one on the back of your card.
- Check your transactions in the app over the coming weeks, and turn on payment notifications.
- Keep the bank’s strong authentication (approval in the app) and never bypass it at someone else’s request.
- Changing your password is not essential at this stage, since no theft of customer credentials has been reported. If your banking password is also used elsewhere, change it for that reason: one password per site.
- Report scam texts (in France: forward to 33700), phishing sites and emails to cybermalveillance.gouv.fr; if your card is charged fraudulently, block it, then report it on Perceval (service-public.fr).
What to do (businesses, not just banks)
The attack came through a supplier and took the form of transfers from a legitimate account. Both points concern any organization that pays suppliers.
- List the suppliers that have access to your payment systems, online banking, accounting software or email, and what each can do. “Just in case” access is one access too many.
- Require strong authentication on that access, with named accounts that are never shared.
- Separate entering and approving transfers, with a threshold above which a second person approves. For a new payee or changed bank details, call back on a number you already know, not the one in the message.
- Watch for unusual transactions: new payees, round amounts, transfers outside business hours, abroad or to cryptocurrency platforms. Ask your bank which alerts it offers.
- Prepare the response: who to call at the bank to stop a transfer, how fast, and who files the complaint. Recovering funds is a race against time, especially once they move into cryptocurrency.
- Warn your staff: fake “following the cyberattack” alerts will target accounting teams too.
For baseline account and email settings (strong authentication, admin accounts, auto-forwarding), see Securing Microsoft 365 and Google Workspace: Baseline Settings. To check a suspicious email, the email header analyzer shows where it really came from.
Key points
- Known: around €100 million diverted from one of the bank’s accounts, through a supplier, part recovered, an investigation opened.
- Unknown: the attacker, the supplier, the exact method.
- For customers, the immediate risk is not a data leak but opportunistic phishing. Never approve anything at a caller’s request.
