Crédit Mutuel Arkéa said attackers reached the bank through a service provider’s platform and used the group’s own account to make fraudulent transfers.

The bank said the transfers went to other banks and did not pass through customer accounts. It rejected reports that its subsidiary Fortuneo was the entry point. Attackers may have converted funds into cryptocurrency, the bank said.

The bank did not confirm reports of €118 million in losses, validating only the order of magnitude. It said some funds had been blocked and recovery efforts were continuing. Customer assets were unaffected, although some transfers were delayed; almost all operations resumed on November 4.

Why it matters

  • The incident shows how access through an external provider can expose a bank’s own transaction channels.
  • The reported loss remains unconfirmed while funds are being assessed and recovered.