🔍 Read the full analysis: What The Timeline Says About The €100 Million Arkéa Hack on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Crédit Mutuel Arkéa said on November 5 that about €100 million was stolen through transactions from the bank’s own account, not customer accounts. The bank says attackers reached it through a service provider; authorities opened an investigation, and the amount recovered or ultimately lost is not yet known.
Crédit Mutuel Arkéa said on November 5 that attackers stole about €100 million by using the bank’s own account to make transfers, after reaching it through a service provider’s platform. The bank says no customer accounts were used and customer deposits are not affected; French authorities opened an investigation on November 4, while the final loss and the amount recovered remain unclear.
The timeline begins with important gaps. Arkéa has not said when the attack started. Le Figaro reported that the incident began at a service provider in late October, but that account has not been confirmed by the bank. The same newspaper reported that information about the attack circulated on X from November 1. Those dates should be treated as reporting, not as an official chronology.
By the morning of November 4, news outlets were reporting a possible theft. Arkéa said it notified relevant authorities and supervisors as soon as it detected the attack, and suspended some transactions as a precaution. Franceinfo reported that the bank’s app was unavailable for several hours. Arkéa said almost all operations resumed during the morning. At 10:29 a.m., Franceinfo reported that more than €100 million had been taken, citing a source close to the case.
In its first public statement, at about 1 p.m. on November 4, the bank said the incident was contained and customer assets were unaffected. A more detailed statement that evening said attackers used an Arkéa account to make transactions to other banking institutions, potentially allowing them to convert the money into cryptocurrency through specialist platforms. On November 5, the bank told Reuters that around €100 million had been stolen. It had previously declined to confirm a reported figure of $133 million, or roughly €118 million, saying it would validate only the order of magnitude. The bank has said some funds were blocked; it has not given a final accounting.
Infographic 01 · Paris time
Hour by hour: what is documented
Every time stamp we could confirm. Dashed rows were reported by one outlet and are not confirmed by the bank.
- Late OctoberA service provider is hit! reportedLe Figaro reports the attack began at a provider of the group, itself attacked at the end of October.
- From 1 NovPosts on X! reported“Information started circulating on X from 1 November” (Le Figaro).
- By 4 Nov, morning$133 million in the crypto press! reportedCrypto outlets and Le Télégramme report $133M (€118M) and name the bank.
- 4 Nov, morningFreeze, complaint, restart✓ confirmedBank informs supervisors, suspends some transactions, files a complaint; app down for hours; almost all operations resume.
- 4 Nov, 13:00First press release✓ confirmed“Closed and under control”; customer assets not affected; phishing warning.
- 4 Nov, 17:30Q&A release✓ confirmedBank’s own account used; entry via a provider’s platform; not Fortuneo; order of magnitude validated.
- 4 Nov, eveningProsecutor confirms investigation✓ confirmedParis cybercrime section, opened that morning; handed to the anti-cybercrime office OFAC.
- 5 Nov“Around €100 million”✓ confirmedBank to Reuters; ECB, French supervisors and prosecutors informed; provider not named.
The money path, as the bank describes it
- 1 · A provider’s platformThe way inProvider not named
- 2 · The bank’s own accountNot customer accountsArkéa Q&A, 17:30
- 3 · Other banksTransfers out“other banking players”
- 4 · Crypto platforms“Potentially” convertedPart of the funds blocked
Still unknown: when the attack began, who the provider is, and how the attackers got control of payments from the bank’s own account.
Sources: Arkéa release, 4 Nov 13:00 · Arkéa Q&A, 4 Nov 17:30 · AFP, 4 Nov 21:50 · Reuters, 4 Nov · Reuters, 5 Nov · franceinfo, 4 Nov · Le Figaro, 4 Nov (paywalled).
Powered by Thorsten Meyer AI
Why a Bank’s Own Account Matters
The incident differs from the customer-focused frauds that commonly dominate reports about banking losses. Arkéa says the funds came from an account belonging to the bank, not from customers’ current accounts or deposits. That distinction matters for customers assessing direct losses, but it does not remove the operational and financial stakes for the institution.
The bank’s account of the route into its systems also points to risk beyond a company’s own network. Arkéa says the attackers came through a service provider’s platform, though it has not identified the supplier or described the access involved. For financial institutions and other businesses, the case underscores that vendors able to connect to systems or initiate transactions can form part of an organisation’s security exposure. The precise weaknesses in this incident have not been established publicly.
Arkéa is a large cooperative banking group based near Brest, with about 5.8 million members and customers, 12,073 employees and reported total assets of €211.5 billion. Those group figures provide scale, but they do not determine the ultimate effect of the theft. The confirmed information so far concerns the bank’s own account, a reported loss of around €100 million and a recovery effort whose outcome is still unknown.
Products Worth Considering
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
How the Public Timeline Emerged
The sequence of public statements matters because early reports gave a more exact figure than the bank was initially prepared to confirm. On November 4, some outlets reported approximately $133 million (€118 million). Arkéa did not confirm that amount. The next day it told Reuters that the stolen sum was around €100 million. These figures are not interchangeable: the bank’s later statement establishes an approximate amount, not a final loss calculation.
Arkéa said the attackers did not enter through Fortuneo, its online bank, and described the incident as an external attack rather than human error on its side. Those are the bank’s statements, not findings published by investigators. The bank has not named the service provider or released technical details about how its platform was used.
The Paris prosecutor’s cybercrime section opened an investigation on the morning of November 4 into suspected organised intrusion into a data processing system. France’s anti-cybercrime office is leading the inquiry, according to the source material. Arkéa said it notified the European Central Bank, French banking supervisors and prosecutors. The investigation is intended to establish the origin and method of the attack; no public finding on either has been reported.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banking players.”
— Crédit Mutuel Arkéa, in its November 4 question-and-answer statement
The Missing Dates and Final Loss
Several central details remain unsettled. Arkéa has not disclosed when the intrusion began, how long attackers had access, or which service provider’s platform was involved. The late-October start date and November 1 circulation of information come from Le Figaro’s reporting and have not been confirmed by the bank.
The final financial impact is also not known. Arkéa told Reuters that around €100 million was stolen and said some funds had been blocked, but it has not stated how much was recovered, whether all blocked funds will be returned, or what sum will ultimately be lost. The earlier €118 million report was not confirmed by the bank. It is also not clear from public information how the attackers authenticated transactions or whether any data was accessed or taken.
The bank says customer accounts and deposits were not affected. No public information in the source material contradicts that statement, but investigators have not yet published their findings. Claims that the attack was unprecedented in Europe were attributed to security commentators, not established by the investigation, and are not necessary to describe what is confirmed.
Investigators Trace the Transfers
The immediate next step is the French investigation into the intrusion and the movement of funds. Investigators are expected to establish how attackers used the service provider’s platform, which accounts received transfers, and whether the money can be recovered. Arkéa says it is working with judicial and police authorities, but no public timetable or next major announcement has been specified.
The bank will also need to clarify the final amount stolen and the status of blocked funds. A fuller public account may depend on the progress of the inquiry and on whether releasing technical details would affect it. Until then, the available timeline should be read as a combination of the bank’s confirmed disclosures and separately attributed media reports.
Customers should be alert to messages that exploit news of the attack. Arkéa warned about possible phishing, and the source material advises that a bank will not ask customers to share their password or a one-time SMS code. Businesses, meanwhile, will be watching for further information about the unnamed provider and the controls around third-party platforms that can reach payment systems.
Key Questions
Was the money taken from Crédit Mutuel Arkéa customers?
No, according to the bank. Arkéa says attackers used the bank’s own account and did not use customer accounts. It has said customer deposits are unaffected.
How much was stolen?
On November 5, Arkéa told Reuters that around €100 million was stolen. The bank had not confirmed an earlier reported figure of €118 million, and the final amount lost remains unknown.
How did the attackers reach the bank?
Arkéa says they came through the platform of one of its service providers. The bank has not named the provider or publicly explained the technical method. It says the attack did not enter through Fortuneo.
Can the stolen money be recovered?
Some funds have been blocked, according to the source material, but Arkéa has not said how much or whether it will be returned. The recovery total is not yet known.
What is happening now?
France’s anti-cybercrime office is leading an investigation opened by the Paris prosecutor’s cybercrime section on November 4. Authorities are examining the intrusion and transfers; no public findings or completion date have been announced.
Source: ThorstenMeyerAI.com
