French banking group Crédit Mutuel Arkéa said on 4 November 2026 that it had been the target of a cyberattack that enabled fraudulent transactions.

In a question-and-answer statement published that day, the bank says the attackers used Crédit Mutuel Arkéa's own account to make transactions to other banks, which then potentially let them convert the money into cryptocurrency through specialised platforms, and that they did not go through the accounts of customers of its federations or subsidiaries.

It says the attackers got in through the platform of one of its service providers and so reached the group directly, denies press reports that the entry point was its online bank Fortuneo, and says this was a sophisticated attack from outside, not human error at Arkéa.

The bank says the incident is now under control, that it informed the competent and supervisory authorities, that some transfers were temporarily suspended and delayed as a precaution, that almost all operations resumed during the morning, and that it is working with judicial and police authorities to establish the origin and method of the attack.

Asked whether €118 million ($133 million) was stolen, Arkéa says it does not confirm that figure and "can only validate the order of magnitude"; it says some of the funds have been blocked, recovery efforts are under way, and the amounts are not of a nature to threaten its financial strength.

It warns customers to expect phishing attempts. (source: Crédit Mutuel Arkéa, our translation) The Record also reported the bank's confirmation of the attack. (source: The Record)