Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

Crédit Mutuel Arkéa confirms large theft via a service provider

5 sources · 5 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Crédit Mutuel Arkéa says attackers used a service-provider path and a bank account for a roughly $100–133 million theft; customer assets were not affected.

Crédit Mutuel Arkéa says attackers reached it through an unnamed service provider’s platform and used one of the bank’s own accounts to send fraudulent transfers to other institutions. Customer accounts and assets were not affected, though some transfers were delayed and the bank warned of follow-on phishing. Outlets differ on the loss: several cite up to about $133 million, Help Net Security says the bank would confirm only the order of magnitude, and DataBreaches.net reports the bank put it near €100 million ($112.61 million). ZachXBT linked the activity to USDC and USDT later moved toward ether and Monero, while DataBreaches.net says the stolen funds were not cryptocurrency when taken. The bank says the attack is contained, some funds were blocked, and French authorities are investigating.

Key facts
  • Access was through an unnamed service provider, not customer accounts.
  • Attackers used one of Arkéa’s own accounts for transfers.
  • Bank rejects a claimed Fortuneo entry point and human error.
  • ZachXBT tracked about $106 million, then about $27 million more.
  • The cooperative has €211.5 billion in assets and over 5.8 million customers.
  • Operations resumed after verification, with enhanced security measures.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 1, 2026ZachXBT flags more than $106 million in suspicious flows. · Help Net Security
  2. Nov 2, 2026ZachXBT is reported to have identified the incident. · Infosecurity Magazine
  3. Nov 3, 2026ZachXBT flags about another $27 million. · Help Net Security
  4. Nov 4, 2026Arkéa says a service-provider platform was used. · Help Net Security

What each outlet adds

beyond the shared facts
  • Help Net SecurityZachXBT split, bank’s magnitude caveat, and disputed Fortuneo link.
  • DataBreaches.netBank figure near €100 million; funds not crypto when stolen.
  • BleepingComputerBank ruled out human error and reported a gradual return to normal.
  • Security AffairsOperations resumed after checks and security was strengthened.
  • Infosecurity MagazinePlaces ZachXBT’s identification of the incident on November 2.
Vendors
Crédit Mutuel Arkéa
Products
banking network
Victims
Crédit Mutuel ArkéaCredit Mutuel Arkea
Organizations
Fortuneo
Countries
France

Coverage

oldest first · one row per article · UTC
  1. · 5d ago BleepingComputerFirst report

    Hackers steal $133 million from French bank via service provider

    Crédit Mutuel Arkéa confirms fraudulent transfers up to 133 million euros through service provider; customer assets unaffected.

  2. · 4d ago Security Affairs

    Hackers Raid French Bank Crédit Mutuel Arkéa

    Attackers exploited a third-party provider to withdraw up to $133 million from the bank's accounts.

  3. · 3d ago Help Net Security

    Crédit Mutuel Arkéa hit by roughly $133 million fraudulent transfers

    The bank confirms only the scale; ZachXBT tracked stablecoins moved toward ether and Monero, and a Fortuneo entry is disputed.

  4. · 3d ago Infosecurity Magazine

    Crédit Mutuel Arkéa Targeted in Reported $133m Heist

    Hackers stole $133m from Crédit Mutuel Arkéa using a service provider platform, converting to cryptocurrency; no customer accounts affected.

  5. · 1d ago DataBreaches.net

    Credit Mutuel Arkea says hackers stole about €100 million

    French prosecutors are investigating fraudulent transactions run through a bank account; the stolen funds were not cryptocurrency.