On 4 November 2026, the French cooperative banking and insurance group Crédit Mutuel Arkéa confirmed that it had been the target of a cyberattack that enabled fraudulent transactions amounting to approximately €100 million.
According to the bank, the attackers used Crédit Mutuel Arkéa’s own proprietary account (compte propre) to carry out transfers to other financial institutions. The funds were then converted into cryptocurrency via specialised platforms. The attackers did not go through the accounts of customers of the group’s federations or subsidiaries.
Access was obtained through the platform of one of the bank’s external service providers. The group stresses that this was a “sophisticated attack coming from outside,” not an internal human error. Contrary to initial reports, the entry point was not the online bank Fortuneo.
Blockchain investigator ZachXBT had previously estimated the damage at more than $133 million (around €118 million). Arkéa itself does not confirm the exact figure but acknowledges the order of magnitude. Part of the funds has been blocked, and recovery efforts are under way. The bank states that the incident has been contained and is now “closed,” operations are gradually resuming, and the scale of the losses does not threaten the group’s financial strength.
For customers of Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo (around 5.6 million customers and cooperative members in total), the incident has no consequences: their funds were not affected. There were only temporary delays in the execution of certain transfers.
The Paris public prosecutor’s office has opened an investigation into an “attack on an automated data processing system by an organised group.” The case has been assigned to the Office anticybercriminalité. The bank has notified the relevant supervisory authorities and is warning customers about possible phishing attempts.
