Crédit Mutuel Arkéa Hit by Cyberattack That Enabled Fraudulent Transfers

Overview

• Arkéa said Wednesday it had been the victim of a cyberattack that allowed fraudulent transactions and that the incident is now under control.
• Independent investigators and multiple outlets estimate the sums taken in the low hundreds of millions of euros, commonly reported around €118m–€150m, while the bank has not confirmed a precise total.
• On‑chain analysis by independent sleuths shows the stolen money was converted into cryptocurrency and moved through multiple accounts on crypto exchanges, complicating recovery and tracing.
• The bank says clients will not bear losses, that some transactions were temporarily suspended while services were progressively restored under tighter security, and that a portion of the stolen funds has been blocked with recovery efforts ongoing.
• The Paris prosecutor opened an inquiry assigned to the Office anticybercriminalité and investigators are probing how attackers gained access, with Arkéa blaming a third‑party service provider while some reports named Fortuneo as involved, raising fresh questions about third‑party risk and links between banks and crypto platforms.