Crédit Mutuel Arkéa says attackers used the bank’s own account after a service-provider hop

a French cooperative bank spent Thursday afternoon answering the question everyone asks after a cyber heist: did the customers lose the money? the bank’s answer is no. the next question is how much walked out of the bank’s own account. on that one, Crédit Mutuel Arkéa will only validate “the order of magnitude” of the 118 million euro figure it will not confirm.

what the bank says happened

in the bank’s words: “The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions to other banks, which may then have enabled them to convert the money into cryptocurrency via specialised platforms.” they “therefore did not go through the accounts of customers of its federations or subsidiaries.” the bank says the incident “has no financial consequences for our customers.”

that last sentence is doing a lot of work, and it is also the one the bank keeps repeating. the FAQ says the only customer-facing effect was “a delay in the execution of certain transfers.” by the 5:30 p.m. note, “this incident is now under control” and “almost all operations resumed during the morning, after the Group and its subsidiaries completed verifications and put enhanced security measures in place.”

how the attackers got in is the part the internet got wrong, according to the bank. question two in the FAQ is: did the attackers get in through Fortuneo, as reported in the press? “No. Despite what has been reported, there was no ‘entry’ through Fortuneo. The attackers went through the platform of one of our service providers and thereby reached Crédit Mutuel Arkéa directly.” Fortuneo is one of the group’s specialised subsidiaries. the bank named it only to say it was not the door.

the bank also rejected the other popular theory, that someone at Arkéa clicked the wrong thing. “Was human error at Arkéa the cause of the attack? No. This was a sophisticated attack from outside, which has now been contained.” it says its security systems identified the suspicious activity “very quickly,” that teams are working with judicial and law-enforcement authorities on origin and modus operandi, and that as a precaution it “temporarily suspend[ed] certain transactions in order to secure operations and prevent any fraudulent movements.”

the number the bank will not confirm

question six of the FAQ is the one everyone screenshot: “Can you confirm that 118 million euros ($133 million) were stolen?”

the bank: “We do not confirm this information and can only validate the order of magnitude.” teams “are continuing their work to assess the financial consequences of this attack precisely: part of the funds concerned has been blocked, and other actions are under way to recover them.” it is “still too early to communicate a final amount,” but “the amounts involved are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa.”

so if your headline says “hackers stole $133 million from a French bank,” you are printing a figure the victim put in a question and then declined to confirm. “order of magnitude” is not a rounding error. it is the bank saying the chatter is in the right neighborhood and the exact total is still in accounting and recovery. we are going to keep saying that out loud.

BleepingComputer, writing on November 7, traced the 118 million euro / $133 million figure to blockchain fraud investigator ZachXBT. according to that report, ZachXBT warned on November 2 of a large-scale unauthorized withdrawal from multiple centralized exchange accounts that had occurred a day earlier, and said the attacker may have stolen up to 118 million euros and withdrawn it as USDC and USDT stablecoins. at the time ZachXBT did not name the entity, and said the lack of public disclosure allowed the attacker to launder $30 million by November 3, money that EU law enforcement would otherwise have frozen. those are ZachXBT’s claims as reported by BleepingComputer, not numbers the bank adopted. SecurityAffairs’ November 8 piece repeated the same through-line and noted that the Paris prosecutor’s cybercrime unit opened an investigation after a complaint from the bank, with France’s cybercrime police leading the probe. we have not independently reviewed a prosecutor’s filing.

phishing warning, without a data-theft claim

the bank’s earlier November 4 note mentioned phishing. the FAQ asks the obvious follow-up: does that mean customer data has been compromised? the bank does not say yes. it says that “in the context of attacks of this nature, it is common to see an upsurge in phishing attempts that may seek to extort confidential data,” and that it is raising customer awareness “as a preventive measure.” customers should stay extremely vigilant. that is not the same sentence as “we lost the customer file.” anyone pitching you a follow-up recovery service is running the oldest play in the book. report those to the bank through a number you already have, not through a number that called you.

who Crédit Mutuel Arkéa is, since the org chart is the attack surface

the same press release’s boilerplate: a cooperative banking and financial services group comprising the federations Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest, their affiliated local banks, and around forty specialised subsidiaries, including Fortuneo, Monext, Arkéa Banque Entreprises et Institutionnels, Arkéa Asset Management, Arkéa Capital, Suravenir, and Arkéa Assurances. 12,073 employees, 2,600 elected directors, more than 5.8 million members and customers, and total assets of 211.5 billion euros. a leading financial partner in Brittany and the South-West of France, currently running a strategic plan it brands “Faire 2030.”

that is a lot of subsidiaries and a lot of “service providers” sitting next to a group account that, in the bank’s telling, was allowed to send money to other banks. the interesting architectural sentence in the FAQ is not the denial about Fortuneo. it is “the attackers used Crédit Mutuel Arkéa’s own account.” customer accounts were not the pivot. a privileged origination path was. if you run treasury, correspondent banking, or a payments processor, that sentence should sound more familiar than you want it to.

what this is not

• it is not a confirmed $133 million theft. the bank validated the order of magnitude and refused the exact figure.
• it is not, according to the bank, an intrusion through Fortuneo, and it is not, according to the bank, human error inside Arkéa.
• it is not a published description of malware, a CVE, or the named service provider. anyone claiming to know the provider or the implant from public reporting is ahead of the primary source.
• it is not a statement that customer deposits were taken. the bank says customer assets were unaffected and that some transfers were delayed.
• it is not proof that customer PII leaked. the phishing warning is framed as a predictable aftershock, not as notification of a stolen database.

what a company that is not a French bank should still do with this

you probably do not have 211.5 billion euros on the balance sheet. you probably do have a vendor that can instruct a payment, push a file to a clearing system, or sit on a jump path into the treasury VLAN “just for support.” the Arkéa FAQ is a checklist disguised as public relations:

• which third parties can originate or approve movements that look like they came from you?
• if one of those parties is abused, do you notice in minutes or after a blockchain investigator posts screenshots?
• can you freeze outbound rails without freezing every customer transfer for a morning, and if you cannot, have you already written down which delays you will accept?
• when you warn customers about phishing, are you notifying them of a data loss or of copycats? say which one, out loud, the way Arkéa at least tried to.

the sloth has read enough “contained, no customer impact, order of magnitude” letters to know the next chapter is either a quiet recovery or a quietly larger number. until the bank or the prosecutor publishes more, the honest version is the one in the PDF: attackers reached the group through a service provider, used the bank’s own account, sent money to other banks, may have cashed out through crypto platforms, customers were not debited, some funds were blocked, and the headline figure is unverified on purpose.

if a vendor can instruct a payment or sit on the path to the account that can, that relationship is worth reviewing before a press release has to do it for you. Book a slot with Dark Edge Consulting.

sources

• Crédit Mutuel Arkéa, “Additional Information Following the Cyberattack on Crédit Mutuel Arkéa” (Brest, November 4, 2026, 5:30 p.m.)
• BleepingComputer, “Hackers pull off $133 million French bank heist via service provider” (Bill Toulas, November 7, 2026)
• SecurityAffairs, “Attackers Exploit Third-Party Provider to Raid French Bank Crédit Mutuel Arkéa” (Pierluigi Paganini, November 8, 2026)