French banking group Crédit Mutuel Arkéa suffered a sophisticated cyberattack that allegedly siphoned an estimated 118 million euros ($132.44 million) from its corporate accounts, though the institution stated that client assets were untouched.
In a Wednesday public statement and a subsequent update, the bank explained that hackers infiltrated its systems through a third-party service provider’s platform. The attackers bypassed client accounts entirely, using Crédit Mutuel Arkéa’s proprietary accounts to transfer funds to other banks. The stolen money was then potentially converted into cryptocurrency on specialized platforms, the bank said.
Addressing media reports that 118 million euros were stolen, the bank did not confirm the exact figure but validated the “order of magnitude.”
“Our teams are continuing their work to precisely evaluate the financial consequences of this attack: a portion of the funds involved has been blocked, and other actions are underway to recover them,” the bank stated. It added that the stolen amounts do not threaten the financial health or stability of the institution, which boasts more than 5.8 million members and clients and a balance sheet of 211.5 billion euros ($237.3 billion).
The bank also refuted rumors that the breach occurred through its online banking subsidiary, Fortuneo, or was the result of human error within Arkéa.
Following the detection of the attack, Crédit Mutuel Arkéa temporarily suspended certain transactions as a precaution, leading to delayed wire transfers for some customers. The incident has since been contained, and operations largely resumed normal functioning the following morning after enhanced security measures were implemented.
The bank said it is currently working with police, judicial authorities, and supervisory bodies to determine the exact origin and methodology of the attack. While the bank confirmed no client data was compromised, it issued a preventative warning to its customers to remain vigilant against phishing attempts, which often surge in the wake of such high-profile incidents, specifically reminding clients never to share passwords, bank card numbers, or SMS validation codes.
Source: OCCRP · 2026-11-05