French Bank Crédit Mutuel Arkéa Reports About €100m Missing After Cyberattack

French lender Crédit Mutuel Arkéa said on Thursday that about €100 million was missing following fraudulent transfers made through a bank-controlled account. The institution said customers’ assets were not affected and that it was working to recover the funds.

The lender said the incident did not involve customers' personal accounts and that their assets were not affected. Some transfers were temporarily delayed while safeguards were put in place. The bank is trying to recover the money, but has not confirmed how much will ultimately be returned.

The incident was disclosed on Wednesday, with further details emerging on Thursday, 5 November. The investigation is being handled by French cybercrime authorities after the bank notified regulators and prosecutors.

How the theft was described

The bank said attackers used access associated with its own account to arrange transfers to other banks. Reports suggest the funds may subsequently have been moved through cryptocurrency platforms, but this does not mean the stolen balance was cryptocurrency in the first place.

That distinction is particularly important amid a series of attacks on financial and technology infrastructure. The original compromise was described as a banking-account transaction fraud rather than a direct theft from retail customers' digital wallets.

The method by which criminals obtained the access has not been conclusively established in public findings. The bank has declined to identify the third-party platform involved, and no individual or group has been publicly confirmed as responsible.

Bank-controlled funds, not customer account balances

The distinction between the bank’s own account and individual customer accounts is central to the reporting. Reuters reported that the fraudulent transactions originated from an account belonging to the lender; Arkéa said the attack did not involve customers’ accounts. The €100 million figure is an amount reported missing during a recovery effort, not an independently established final net loss.

The bank’s earlier 4 November statement reported by AFP described the scale of losses while the total was still being assessed. Readers should distinguish the early disclosure from the updated estimate reported on Thursday.

Financial institutions confront a different risk

Crédit Mutuel Arkéa serves millions of customers and operates under European banking supervision. A loss of this size from a bank-controlled channel raises questions about transaction authorisation and monitoring even where customer balances are protected.

The Paris prosecutor's cybercrime unit opened an inquiry. Separately, the lender told supervisors about the incident and said its financial health was not at risk because of the attack.

Some commentators have linked the case to broader concerns over weaknesses in financial infrastructure, but the investigations should determine what actually happened before conclusions are drawn about any shared vulnerability with other recent attacks.

For account holders, the bank's central assurance is that customer assets were unaffected. Customers experiencing an unusual transfer delay should rely on official bank communications, rather than messages claiming to offer urgent recovery assistance.

The value at issue remains an estimate while the recovery operation continues. Authorities have not announced a final loss amount or identified the attackers.

Reporting sources

• Reuters – bank statement and investigation
• AFP – initial disclosure, 4 November
• Le Monde – bank cybersecurity context

ABOUT THE AUTHOR

Musa Ersoy

Musa Ersoy is an editor and writer at DEFUXA Global News, covering developments in the United Kingdom and around the world. He researches news stories using official statements, credible sources and independently verifiable information. His editorial work focuses on factual ac…

Author profile and articles