French prosecutors probe €100m cyberattack on Crédit Mutuel

Crédit Mutuel Arkéa hit by major cyberattack

French prosecutors opened an investigation on 4 November after Crédit Mutuel Arkéa reported a sophisticated cyberattack involving fraudulent transfers estimated at around €100 million.

Bank says customer accounts were safe

Crédit Mutuel Arkéa confirmed the attack on Wednesday, saying hackers targeted its own accounts rather than customer accounts, insisting that client savings and deposits were safe.

Entry point was external service provider

Attackers gained access to Crédit Mutuel Arkéa's systems through the platform of an external service provider, allowing them to initiate fraudulent transfers from the bank's own account.

Funds converted to cryptocurrency

The stolen money may have been converted into cryptocurrency through specialised trading platforms, potentially complicating efforts to trace and recover the funds.

Fortuneo subsidiary not compromised

Crédit Mutuel Arkéa stressed that its online banking subsidiary Fortuneo had not been used as an entry point and that no customer accounts had been accessed.

Reports suggest €118 million diverted

French regional newspaper Le Télégramme and cryptocurrency news outlet CoinDesk reported that as much as €118 million had been diverted. The bank declined to confirm that figure.

Bank assesses financial impact

The bank said some money had already been blocked while efforts continued to recover the remainder. A spokesperson said it was too early to give a final figure.

“Our teams are continuing their work to precisely assess the financial consequences of this attack. It is still too early to give a final figure.”

Attack quickly detected and contained

Crédit Mutuel Arkéa's security systems quickly detected suspicious activity, allowing it to contain the attack and temporarily suspend certain transfers. Almost all operations resumed by Wednesday morning.

No impact on customer assets

The bank insisted that the incident had no impact on customer assets and had only caused a delay in the execution of certain transfers. Financial stability was not at risk.

“This incident has had no impact on customer assets and has only caused a delay in the execution of certain transfers.”

Crédit Mutuel Arkéa's scale and reach

Headquartered near Brest, Crédit Mutuel Arkéa serves 5.8 million customers and manages more than €211 billion in assets. The group reported a net profit of €230 million in the first half of 2026.

Growing concern over cyber threats

The attack comes amid growing concern among European regulators over cyber threats to financial institutions, particularly as banks rely increasingly on interconnected systems and external service providers.

AI advances raise attack sophistication fears

Advances in artificial intelligence have raised fears of more sophisticated attacks, making cybercrime harder to detect and prevent among financial institutions.

Investigation seeks attackers' identity

Investigators are seeking to establish how attackers gained access, who was responsible and where stolen funds were transferred. The attack has not been publicly claimed.