Compliance and Audits

Crédit Mutuel Arkéa: attackers used a provider's platform to send transfers from the bank's account, an estimated €118M

French banking group Crédit Mutuel Arkéa confirmed a November 4, 2026, attack in which attackers accessed the bank’s own account via a third-party service provider platform and initiated transfers to other institutions. Analyst ZachXBT estimates the loss at €118M; the bank confirms only the order of magnitude.

  • SourceBleepingComputer
  • Source publicationNovember 7, 2026
  • TypeThreats and incidents

What happened

According to a bank statement cited by MoneyVox, attackers used Crédit Mutuel Arkéa’s own account for transfers to other banks, which may have subsequently enabled the conversion of funds into cryptocurrency. The bank describes it as a “sophisticated external attack” and rules out human error. Entry was gained through an undisclosed service provider platform; the bank denied the attack involved its Fortuneo online banking service.

ZachXBT, who first reported the theft, values it at €118M ($133M). According to BleepingComputer, the first unauthorized withdrawals from crypto exchange accounts occurred on November 1, and approximately $30M was laundered by November 3. ZachXBT suggests some funds could have been frozen if the incident had been disclosed sooner. The bank stated that some funds were blocked and efforts to recover the rest are ongoing.

Customers experienced transfer delays; in the Fortuneo app, the bank warned of disruptions to instant transfers and Wero payments. The bank maintains the incident does not affect customer funds or its financial stability and warns against phishing impersonating the bank. French law enforcement is investigating. According to CSO Online, the group serves 5.8 million customers.

Key findings

  • Entry via an undisclosed service provider platform; the target was the bank’s own account, not customer accounts.
  • Loss: Approximately €118M ($133M) per ZachXBT; bank confirms the order of magnitude, some funds frozen.
  • Timeline: Nov 1 exchange withdrawals, Nov 2 initial reports, Nov 4 bank statement.
  • Approx. $30M laundered by Nov 3 (ZachXBT estimate).
  • Customer impact: Delayed transfers, disruptions to instant transfers and Wero payments at Fortuneo.

Why it matters

SafeWave CommentaryThis is a risk that DORA explicitly requires banks to manage: a third-party ICT provider with access to payment systems can become a gateway to the bank’s money, bypassing customer channel security. For financial institutions in Poland, this raises specific questions: which providers have the technical capability to initiate or approve transfers from the bank’s own accounts; is their access limited to the necessary scope, MFA-protected, and logged; do transfers from the bank’s own accounts have limits, a four-eyes principle, and real-time anomaly monitoring; do ICT provider contracts stipulate immediate incident notification and audit rights; does the response plan include rapid contact with crypto exchanges and law enforcement to freeze funds. Assessing ICT providers and the register of information are part of the Compliance and Audits area; provider dependency was also highlighted by ENISA as a major trend in the Threat Landscape 2026.