French prosecutors have opened an investigation into the cyberattack on Crédit Mutuel Arkéa, the bank confirmed on Wednesday, 4 November 2026, after the group filed a complaint. According to Linternaute.com, the Paris case has been assigned to the office anti-cybercriminalité (OFAC) and concerns "atteinte à un système de traitement automatisé de données en bande organisée" — an organised attack on an automated data-processing system.
The bank said the incident is now under control and that fraudulent transactions may have taken place, Linternaute.com reports. It has not confirmed how much money, if any, was taken.
Why it matters
Arkéa is one of France's larger banking groups, and its brands reach well beyond its home region in Finistère. The group includes two Crédit Mutuel networks — Crédit Mutuel de Bretagne and Crédit Mutuel Sud-Ouest — along with the life-insurance specialist Suravenir and the online bank Fortuneo. Other Crédit Mutuel branches belong to a separate group.
That spread explains the attention the case has drawn. Le Monde reported that the attack has pushed European banks to confront how exposed they are, while Les Echos described how the intruders reached the group's vault. Le Figaro reported that information about the incident began circulating on X from 1 November.
How the attackers got in, according to the bank
Arkéa has pushed back on several early theories. Linternaute.com reports that the group denied any entry through Fortuneo, the online subsidiary that some experts had suspected as the weak point. The bank said the hackers did not use accounts belonging to customers of its federations or subsidiaries.
Instead, the group said the attackers went through the platform of one of its service providers and reached Crédit Mutuel Arkéa directly from there. It also rejected the idea of an internal human error, describing what happened as a sophisticated attack launched from outside.
On Wednesday evening, the bank gave more detail on the mechanics. According to Linternaute.com, it said the hackers used Crédit Mutuel Arkéa's own account to send transactions to other banking institutions, then converted the money into cryptocurrency through specialised platforms.
The disputed figure
The amount involved remains unconfirmed by the bank. Le Télégramme reported a figure of $133 million, roughly €118 million, citing numbers from independent investigator ZachXBT, who had written about the attack on Wednesday morning. ZachXBT has built a reputation for tracking funds moved into cryptocurrency — a route that appears central to this case, since the money was reportedly converted after being transferred out.
Arkéa has not verified that sum. On Wednesday evening it said part of the funds concerned may have been blocked, with further steps under way to recover the rest. It added that the amounts affected were still being assessed and were not of a scale to call into question the group's financial strength.
What it means for customers
The bank has stated repeatedly that clients will not bear a financial loss. In its Wednesday morning statement, it said the incident has no financial consequences for customers and that their interests are fully protected.
Some transfers could not be completed on Wednesday, and the group acknowledged that payments were delayed. It said it had suspended certain transactions as a precaution once the attack was detected, in order to secure operations and prevent further fraudulent movements, and that normal service would resume quickly once final checks and security measures were complete.
Linternaute.com notes that even in a scenario where customer accounts had been debited — something the bank's account does not establish — European rules would require the group to reimburse affected depositors. The likelier target, the outlet suggests, was the bank's own funds rather than client money.
What to watch
The OFAC investigation will now examine how the intrusion was carried out and where the funds went. The key questions are whether the reported eight-figure sum is confirmed, how much of it can be recovered from the cryptocurrency platforms involved, and what the case means for the third-party providers that connect banks to the outside world.
