For: customers of Crédit Mutuel Arkéa (including Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and subsidiaries such as Fortuneo), and companies that connect outside providers to their payment and transfer systems. This article is based on Crédit Mutuel Arkéa's official statements and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
customers of Crédit Mutuel Arkéa (including Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and subsidiaries such as Fortuneo), and companies that connect outside providers to their payment and transfer systems.
- Confirmed so farSee the table ↓
- Fraudulent transfers from its own account
- Transfers to other banks
- Entry through a service provider's platform
2 more
- Some transfers executed late
- Part of the funds blocked
Listed as possibly affected
- Conversion into cryptocurrency
- Not yet confirmed
- The final amount and how much can be recovered
- The service provider's platform and how the intrusion unfolded
- Whether funds sent to other banking players were converted into cryptocurrency
2 more
- The outcome of the authorities' inquiry
- Full resolution of the delayed transfers
- What to do nowSee the steps ↓
- Know whether you are affected: customer accounts were not used
- Do not open links in messages claiming to be the group, and share no secrets
- Confirm through a channel you open yourself, or ask your adviser directly
2 more
- If a transfer of yours was delayed, check it in the official app
- Companies: list provider connections and privileges (the first thing to do)
- Where to verify (source)All sources ↓
- Crédit Mutuel Arkéa, "Crédit Mutuel Arkéa annonce avoir été victime d'une attaque" (press release, November 4, 2026, in French)
- Last checked
- As of November 7, 2026
Follow-up plans and what we checked
The group published a press release and supplementary statement on November 4 and says it will communicate on developments as soon as new elements are available. We checked its press release list on November 7 and found nothing newer than those two items.
What customers and companies should do today
Know whether you are affected: customer accounts were not used
The group says the attackers used Arkéa's own account and did not go through the accounts of customers of its federations or subsidiaries. It says customer assets are unaffected and that only some transfers were executed late.
Its statements do not ask customers to change passwords or take similar steps. They also do not say whether any customer data was compromised (see the table below).
Do not open links in messages claiming to be the group, and share no secrets
The group warns that phishing attempts are possible after this attack and asks customers never to share their ID, password, card number or the validation code received by SMS.
This applies to messages saying "to complete your transfer" or "to protect your account". A message that correctly mentions what you saw in the news is not proof that it is genuine (this site's advice; see What is phishing?).
Confirm through a channel you open yourself, or ask your adviser directly
If in doubt, the group says to contact your bank adviser directly to confirm that a message is genuine.
If you have no adviser, this site suggests using the app on your home screen or an official site you bookmarked yourself, not a link or phone number from the message.
If a transfer of yours was delayed, check it in the official app
The group says it temporarily suspended certain transactions to prevent further fraud and that nearly all operations resumed on the morning of November 4. Check the status of a delayed transfer in the official app or website that you open yourself.
A message that has you enter details on a linked page to "restart a blocked transfer" is not a step the group has described. Do not follow it (this site's advice).
Companies: list provider connections and privileges (the first thing to do)
The group says the attack reached it through a service provider's platform. If you connect outside providers to your payment and transfer systems, start by listing which provider has which connection and which operations it may perform.
Record separately whether each one can only view, can create transfer data, or can approve and execute. The review points are explained in the section for companies below.
What happened (from Crédit Mutuel Arkéa's statements)
The group published a press release on November 4, 2026, and later the same day a supplementary statement answering the main questions it had received. Everything below is based on those two documents.
Detection (date not published)
The group says an attack allowed fraudulent transactions. After detecting it, it followed usual procedures and informed the competent and supervisory authorities, and temporarily suspended certain transactions to prevent further fraudulent movements.November 4 (Wed), morning
Operations resumed progressively. The group says nearly all had resumed during the morning.November 4
Press release and supplementary statement (answers to questions) published. The group says the incident is closed and under control.November 7
This site checked the group's press release list. Nothing newer than the two items of November 4 was found.
External attackers
Described by the group as a sophisticated external attack
↓ reached the group through a service provider's platform
Crédit Mutuel Arkéa's own account
Accounts of customers of the federations and subsidiaries not used (group)
↓ transfers to other banking players
Other banking players
May then have been converted into cryptocurrency (group). Part of the funds blocked
- What happened
- An attack allowed fraudulent transactions. The group says the incident is closed and under control (November 4)
- Entry point (group's account)
- It reached the group directly through a service provider's platform. The provider and the method are not published
- Account used
- Arkéa's own account. The accounts of customers of its federations and subsidiaries were not used
- Where the money went
- Transfers to other banking players, which may then have let the attackers convert the money into cryptocurrency through specialised platforms
- Denied by the group
- Human error at Arkéa as the cause. Press reports that the intrusion came through its online bank subsidiary (Fortuneo)
- Customer impact
- No impact on customer assets. Some transfers executed late. Nearly all operations resumed on the morning of November 4
- Amounts involved
- Being assessed; not yet at the stage of publishing a final amount. Part of the funds blocked and recovery actions under way. The group says the amounts are not of a nature to affect its financial soundness
- Figure raised in press and Q&A
- For the 118 million euros (133 million dollars) raised as a question in the group's supplementary statement, the group did not confirm it and said the order of magnitude is valid
- Authorities
- Informed the competent and supervisory authorities per usual procedures; working with judicial and police authorities on the origin and method
- Message to customers
- Phishing is possible; never share ID, password, card number or SMS validation code; if in doubt, contact your bank adviser directly
- Size of the group (group's description)
- 12,073 employees and more than 5.8 million members and customers
What is known and not yet known
The state as of November 7, 2026 (reflecting the press release and supplementary statement of November 4). This table will be rewritten when follow-ups appear.
| Item | What the group says | Status |
|---|---|---|
| Fraudulent transfers from its own account | An attack allowed fraudulent transactions, using Arkéa's own account | Confirmed (company) |
| Transfers to other banks | Transfers to other banking players were made | Confirmed (company) |
| Entry through a service provider's platform | The group's account; provider and method not published | Confirmed (company) |
| Some transfers executed late | Some transfers were delayed; nearly all resumed on the morning of Nov 4 | Confirmed (company) |
| Part of the funds blocked | Part of the funds was blocked; recovery actions under way | Confirmed (company) |
| Conversion into cryptocurrency | May have been possible through other banking players | Possible (company) |
| Effect on customer assets | None | Not included (company) |
| Customer or subsidiary accounts used | They were not | Not included (company) |
| Human error at Arkéa as the cause | Denied; a sophisticated external attack | Not included (company) |
| Intrusion via the online bank subsidiary (Fortuneo) | Denied; reached the group directly via a provider's platform | Not included (company) |
| Customer personal data | Not stated (Q7 describes a precautionary warning; no statement on whether data leaked) | Not stated |
| Amounts involved | Being assessed. For the 118 million euros raised in the supplementary statement's question, not confirmed, order of magnitude valid; final amount not yet published | Under investigation |
| Amount recoverable | Recovery actions under way; no amount published | Under investigation |
| Service provider and method | Not published; being established with the authorities | Under investigation |
| Contact with authorities | Competent and supervisory authorities informed; judicial and police authorities working with the group | Done |
How to read the amount: the figure is not one the group confirmed
118 million euros is a figure from the press and from a question in the group's supplementary statement. The group did not confirm it, saying only that the order of magnitude is valid, and says it is not yet at the stage of publishing a final amount.
For that reason this site does not treat the amount as the group's number. We will rewrite this article when the group gives a final figure.
What this kind of case can lead to
As the group says, customer assets are not affected. Two things can still matter to users. The following is what can generally happen in a situation like this, not something the group has said happened here.
- When a bank incident or fraud makes the news, phishing built around "checking your account", "restarting a blocked transfer" or "compensation" tends to circulate. Knowing the news is enough to make such a message look genuine
- When a provider's system is the way in, the bank's screens and procedures stay genuine and nothing looks different to customers. What customers can do is mostly to not respond to fake messages
What companies should review: provider connections into payment and transfer systems
What is known: the attack reached the group through a service provider's platform, money was sent from its own account to other banking players, and the group says its systems spotted suspicious activity quickly and that it suspended certain transactions. The method has not been published, so only general review points that follow from the published sequence are given here. They do not mean the group or its provider failed to do them.
List provider connections and privileges
For each outside provider involved in payments and transfers, write down how it connects, which account it uses and which operations it may perform. Separating view-only, creating transfer data, approving and executing will show privileges that are too wide.
Separate the right to create from the right to approve and execute
Check that no provider connection can take a transfer from creation all the way to execution. If execution requires approval by a person outside the provider's system, a compromise of one connection alone does not move funds.
Set limits and holds on destinations and amounts
Put limits on new destinations, unusual amounts and rapid series of transfers, and add a hold and a second-channel confirmation before execution. A first rule to try: hold every transfer to a new destination, whatever the amount, until a second person confirms it by phone or another channel.
Decide the stop procedure in advance
The group suspended certain transactions after detection. Decide before an incident who may order a stop and how you resume. A prepared customer notice also lets you communicate faster.
Organisation-wide priorities are in Security baseline for organizations.
Sources (public records)
The facts in this article are based on the public information below. We do not speculate on the name of the service provider or on how the intrusion happened, which have not been published.
- Crédit Mutuel Arkéa, "Crédit Mutuel Arkéa annonce avoir été victime d'une attaque" (press release, November 4, 2026, in French) — cm-arkea.com (PDF)
- Crédit Mutuel Arkéa, "Informations complémentaires suite à l'attaque dont le Crédit Mutuel Arkéa a été victime" (supplementary statement, November 4, 2026, in French) — cm-arkea.com
- The group's press release list (checked November 7; nothing newer than the two items of November 4) — cm-arkea.com
Update history
2026-11-07: First version. Based on the group's press release and supplementary statement of November 4, 2026 (checked November 7; nothing newer found). The group says it will communicate on developments as soon as new elements are available. We will update this article when it does.
Read next
- Same type of case (an outside provider's systems): Unauthorized access to a Daiwa Securities contractor
- A cryptocurrency theft: Bitget crypto theft (about $387.5 million)
- Preparing for scam messages: What is phishing? / Choosing multi-factor authentication
- Organisation-level preparation: Security baseline for organizations
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)