Crédit Mutuel Arkéa Confirms Cyberattack Involving Fraudulent Transfers

French bank Crédit Mutuel Arkéa confirmed a cyberattack on November 4, 2026, that enabled attackers to carry out fraudulent transactions. According to the bank, it was a sophisticated external incident, and neither customer accounts nor customer assets were affected.

According to Arkéa, the attackers used an unnamed vendor’s platform to gain direct access to the bank. The transfers were not made from customer accounts but from the financial institution’s own account. The case therefore highlights risks in the payment infrastructure supply chain.

Crédit Mutuel Arkéa attack through a vendor platform

The bank has not yet disclosed the vendor’s name or technical details of the incident. It is therefore not known exactly how the attackers gained access, or whether they exploited a vulnerability, used stolen credentials, or employed another method.

Arkéa said that part of the transferred funds was frozen and that it is trying to recover the rest. According to the bank, the incident is under control. In response, it also temporarily restricted some transactions, without specifying the scope of those restrictions.

The preliminary scale of the case is around 100 million euros. The bank did not confirm the precise widely reported sum of $133 million, but it did confirm the approximate order of magnitude of the reported damage. The final loss will also depend on how much of the money can be recovered.

Paris prosecutor’s office leads investigation

After the bank filed a criminal complaint, the Paris prosecutor’s office opened an investigation. According to AFP, it assigned the investigation to the French OFAC office. The attackers’ identities, motivation, and the exact destination of the funds have not yet been publicly confirmed.

Reports have emerged of financial transfers into cryptocurrencies in connection with the incident. However, it has not been independently verified that all funds tracked in this case were transferred in this way. This is based on the bank’s description and reported blockchain findings.

What will matter next

The Crédit Mutuel Arkéa case is particularly significant because, according to the bank, it did not require access to individual customer accounts. Access through an external vendor’s platform was reportedly sufficient to make transfers directly from the institution’s account.

• Official figures for the damage and the amount of funds frozen or recovered.
• Investigators’ findings about the attackers and the affected vendor.
• Any further information about the impact on customer data and the bank’s operational restrictions.

Verified and updated: 11/05/2026 06:29