Crédit Mutuel Arkéa theft hit bank's own account, not customers

Attackers used Crédit Mutuel Arkéa's own account to send money to other banks, the French group said on 4 November. The loss falls on the bank itself rather than on its customers, and Arkéa has not said whether it is insured.

The Brest-based group said the attackers "passed through the platform of one of our suppliers" and that customer accounts were not used for the fraudulent transfers and customer assets were unaffected. It ruled out human error at Arkéa and called it "a sophisticated attack from outside".

Arkéa said it would not confirm reports that €118m ($133m) was stolen, but could "validate the order of magnitude". Part of the funds has been blocked and other recovery steps are under way, it said, so a final amount is not yet available.

The group said it had informed the relevant supervisory authorities and is working with judicial and police authorities. The Paris prosecutor's cybercrime section has opened an investigation after a complaint from Arkéa, 01net reported, citing AFP.

Related coverage: M&S cyber insurance stayed at £100m as attack costs head for £134m; NCSC: four routes behind 88% of large-firm incidents it handled.

Sources

• Crédit Mutuel Arkéa: press release, 4 November 2026 (PDF, French)
• Crédit Mutuel Arkéa: further information on the attack, 4 November 2026 (French)
• 01net: Cyberattaque du Crédit Mutuel Arkéa, tout ce que l'on sait sur l'enquête en cours

CoverWire is a news and information service. Nothing here is investment advice.