Short answer
Crédit Mutuel Arkéa confirmed on 4 November 2026 that it suffered a sophisticated external attack. It says attackers entered through a service provider's platform and used the bank's own account to send transfers, while customer accounts and assets were not affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Crédit Mutuel Arkéa |
|---|---|
| Incident type | Crypto theft |
| Status | Confirmed by the organization |
| Sector | Banking |
| Country | France |
| Disclosed | 2026-11-04 |
| People or records affected | The bank's own funds, estimated at about 118 million euros (133 million dollars) by an outside investigator. The bank says it can validate the order of magnitude |
What data was exposed
- No customer data compromise has been stated by the bank
- Funds moved from the bank's own account to other banks, then possibly converted to cryptocurrency
What happened
Crédit Mutuel Arkéa, a French banking group, announced on 4 November 2026 that it had been the victim of a cyberattack. The details first surfaced on 2 November, when the blockchain investigator ZachXBT reported them and later named Arkéa, according to The Record. ZachXBT said the activity ran over several days.
In its press releases, Arkéa says the attackers used the bank’s own account to send transfers to other banking institutions. That may then have let them convert the money into cryptocurrency through specialized platforms. Some of the converted assets have been frozen, and the bank says it is working to recover the rest.
How the attackers got in
Arkéa says they reached the bank through the platform of a service provider that it has not named. It disputed French press reports that they entered through Fortuneo, its online banking subsidiary, and it says Fortuneo was not an entry point. The bank describes the attack as external and sophisticated, and not the result of human error.
The amount
The Record reported ZachXBT’s estimate of more than 133 million dollars, based on withdrawals from exchange accounts and laundering transactions. Arkéa did not confirm the figure but said it could “validate the order of magnitude.” Its notice cites about 118 million euros. The bank says the sum is not large enough to threaten its solvency or financial health, and that the final loss is not yet established.
Customer impact
According to Arkéa, customers’ assets are not impacted and the incident is under control. The only effect it reports is delayed execution of some transfers, with some operations paused as a precaution before most resumed the same morning after checks and stronger security measures. It has informed its supervisors and is working with judicial and police authorities on the origin and method of the attack.
Arkéa does not say customer data was taken. It warns that phishing attempts often rise after attacks like this and asks customers to stay vigilant.
What customers should do
If you bank with Crédit Mutuel Arkéa or one of its brands, treat any message that mentions the attack as suspect. Never confirm codes or move money to a “safe account” on the strength of a call or message. Our guides on bank transfer scams and phishing messages explain the common tricks, and the data breach checklist covers what to do if you clicked.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and texts posing as Arkéa or its brands such as Fortuneo asking you to confirm details after 'the attack'.
- Phone calls from a fake bank fraud department urging you to move money to a 'safe account'.
- Fake security alerts that link to a copy of the online banking login page.
What to do if you are affected
- 01Do not click links in messages that mention the attack. Open your bank's app or type its address yourself.
- 02Never share one-time codes, card details or online banking credentials, whatever the caller or message claims.
- 03Check your accounts for transfers you did not make, and report any to your bank straight away through its official number.
- 04Expect that a few transfers were delayed. Arkéa says this was the only customer effect.
Frequently asked questions
Were Arkéa customers' accounts accessed?
Arkéa says no. It says the attackers used the bank's own account, not client accounts of its regional federations or subsidiaries, and that customer assets are not affected. The only customer effect it describes is delayed execution of some transfers.
How much money was taken?
Arkéa has not confirmed a figure. The blockchain investigator ZachXBT estimated more than 133 million dollars, and the bank said it can validate the order of magnitude. It says part of the funds has been blocked and it is working to recover the rest.
How did the attackers get in?
Arkéa says they went through the platform of one of its service providers, which it has not named. It rejects press reports that they entered through its online bank Fortuneo, and says the attack was sophisticated and not caused by human error.
Was customer personal data stolen?
Arkéa's notices do not say customer data was compromised. They do warn that phishing attempts often rise after such attacks, so customers should stay alert.
Sources
- Crédit Mutuel Arkéa annonce avoir été victime d'une attaque, Crédit Mutuel Arkéa, 2026-11-04
- Informations complémentaires suite à l'attaque dont le Crédit Mutuel Arkéa a été victime, Crédit Mutuel Arkéa, 2026-11-04
- French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million, The Record, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.