French bank Crédit Mutuel Arkéa reports €100m stolen in cyberattack

French banking group Crédit Mutuel Arkéa is working to recover approximately €100 million (US$112.61 million) stolen by hackers in a cyberattack that targeted an account belonging to the institution rather than its customers.

The Brittany-based lender confirmed the estimated amount on Thursday (November 5, 2026), a day after disclosing the incident, which involved unauthorised transfers carried out through the platform of an external service provider.

The bank reported that the attackers had used its own account to transfer money to other banks. The stolen funds were not originally held in cryptocurrency, although they may subsequently have been converted into digital assets.

Crédit Mutuel Arkéa declined to identify the service provider involved in the breach.

The attack prompted the bank to temporarily suspend certain transactions as a precaution, causing delays to some money transfers. However, it maintained that customers' assets had not been affected.

The lender also rejected reports that Fortuneo, its online banking subsidiary, had been used to gain access to its systems. It stressed that neither Fortuneo nor its customers' accounts were involved.

French authorities launch cybercrime investigation

The Paris prosecutor's office confirmed that its cybercrime unit had received a complaint from Crédit Mutuel Arkéa on November 4 and immediately initiated an investigation.

The inquiry is being conducted by France's specialist cybercrime police.

The bank has informed the European Central Bank, French banking supervisors and prosecutors about the incident. France's banking regulator declined to comment.

Cyber theft raises concerns for banking security

Cybersecurity specialists described the attack as unusual because hackers rarely succeed in stealing substantial sums directly from established banking institutions.

Rafay Baloch, chief executive of cybersecurity and security engineering company RedSecLabs, characterised the incident as unprecedented in Europe.

He highlighted the growing sophistication of cyberattacks targeting banking applications, alongside increasingly complex social-engineering attempts directed at financial institutions.

Puneet Kakkar, managing director at investigations firm Nardello & Co in Paris, also highlighted the significance of a successful attack on the banking system.

He noted that French banks generally maintained strong cybersecurity standards because of regulatory requirements, but that criminals were adopting increasingly inventive and opportunistic methods.

Financial regulators worldwide have intensified their focus on cyber threats, particularly as artificial intelligence becomes more widely used.

The incident follows a separate cyberattack in which US$6.3 billion in cryptocurrency was stolen from Binance last week. Europe has also experienced a series of attacks targeting internet-connected refrigeration systems.

Although major bank thefts remain uncommon, previous incidents demonstrate the potential scale of financial cybercrime.

In 2016, attackers stole US$81 million from an account belonging to Bangladesh's central bank at the Federal Reserve Bank of New York. Banks in Russia and India have also suffered multimillion-dollar losses in cyberattacks.

Crédit Mutuel Arkéa is a French co-operative banking group serving more than 5.8 million customers, with total assets of €211.5 billion.

It operates within the wider Crédit Mutuel banking network and is affiliated with the network's central organisation, while retaining substantial independence over its business strategy.

Source: Reuters