2026-11-07
Crédit Mutuel Arkéa Cyberattack (France): Fraudulent Transfers From Its Own Account via a Service Provider's Platform, Customer Assets Unaffected
On November 4, 2026, the French financial group Crédit Mutuel Arkéa said it was hit by an attack that allowed fraudulent transactions. According to the group, the attackers reached it through the platform of a service provider and sent money from Arkéa's own account to other banking players, which may have let them convert it into cryptocurrency via specialised platforms. Accounts of customers of its federations and subsidiaries were not used, customer assets are unaffected, and only some transfers were executed late, with most operations resuming on the morning of November 4. The group denied human error and denied that the intrusion came through its online bank subsidiary. The amounts involved are still being assessed: for the 118 million euros (133 million dollars) that its supplementary statement raised as a question, it said the order of magnitude is valid and that it is not yet at the stage of publishing a final amount. Part of the funds was blocked and recovery is under way. It warns of phishing. This site's bottom line: customers should not open links in messages claiming to be from the group and should check through official channels they open themselves; companies should review the connections and privileges that service providers hold into their payment systems.