French cooperative banking group Crédit Mutuel Arkéa has suffered a major cyberattack in which hackers allegedly stole around €100 million (approximately $112.6 million) through fraudulent transactions. The incident, disclosed on November 4, has triggered a criminal investigation in France and raised fresh concerns about cybersecurity risks facing traditional financial institutions.
The bank confirmed on November 5 that attackers used an account belonging to the institution to carry out unauthorised transactions. It is now working with authorities and financial institutions to recover the missing funds.
Importantly, the bank said customer accounts and assets were not affected.
Hackers Exploited a Third-Party Service Provider
According to Crédit Mutuel Arkéa, the attackers gained access through the platform of one of its external service providers. This allowed them to reach the bank directly and initiate fraudulent transfers to other financial institutions.
The bank rejected media reports suggesting that its online banking subsidiary, Fortuneo, was used as the entry point. It clarified that neither Fortuneo nor its customers’ accounts were involved in the incident.
Arkéa also ruled out internal human error, describing the incident as a sophisticated external attack. However, it has not disclosed the technical vulnerabilities exploited or identified the service provider involved.
Stolen Money May Have Been Converted Into Cryptocurrency
The attackers reportedly transferred the funds through other banks before potentially converting them into cryptocurrency using specialised platforms.
The bank has not confirmed the exact amount stolen. While reports suggested that €118 million ($133 million) was involved, Arkéa said it could confirm only the approximate scale of the incident. It also disclosed that some of the funds had been blocked and recovery efforts were continuing.
Blockchain analysis reported by financial media indicated that the stolen money moved through multiple cryptocurrency platforms and wallets. Tracking and recovering such funds can be difficult, particularly after they are converted into digital assets.
Bank Suspended Some Transactions, Customers Unaffected
Following the discovery of the attack, Crédit Mutuel Arkéa temporarily suspended certain transactions as a precautionary measure. This resulted in delays in processing some transfers.
The bank subsequently introduced additional security measures and said almost all operations had resumed by the following morning. It reassured customers that their deposits and financial assets remained safe.
The group has more than 5.8 million customers and approximately €211.5 billion in assets. It said the financial impact of the incident would not threaten its overall financial stability.
French Authorities Launch Cybercrime Investigation
The Paris prosecutor’s office received a complaint from the bank on November 4 and opened an investigation led by France’s cybercrime police.
The investigation will examine how the attackers accessed the bank’s systems, how the fraudulent transactions were authorised and where the stolen funds were transferred.
The incident is unusual because successful attacks resulting in substantial financial theft from established banks remain relatively rare. Cybersecurity experts have described the operation as particularly significant for the European banking industry.
The breach also highlights the risks associated with third-party technology providers, whose platforms can become potential entry points into financial institutions.
With banks increasingly dependent on interconnected digital systems and external service providers, the Arkéa incident serves as another warning that even heavily regulated financial organisations remain vulnerable to sophisticated cybercriminal operations.
