The facts

  1. AFP reported that Arkéa said a cyberattack enabled fraudulent transfers estimated at about €100 million from the group’s accounts. [1]

  2. OCCRP reported estimates of €118 million, while Le Monde described the bank’s assurance that client assets were unaffected. The estimates are not reconciled. [2][3]

  3. In a 4 November follow-up release, Arkéa said the attackers used its own account through a platform operated by a third-party service provider; the bank did not identify the attacker. [5]

  4. In its 4 November statement, Arkéa said the incident was closed and controlled, operations were resuming progressively after security checks, customer assets were unaffected and the amounts involved were still being evaluated. [4]

  5. Arkéa said customer accounts and assets were unaffected, some transfers had been delayed during security checks and operations were resuming progressively. [5]

Still unconfirmed

  • The exact amount involved, identity of the attackers and whether all fraudulent transfers were recovered remain unknown. Media estimates of about €100 million and €118 million have not been reconciled by the bank.

Corrections & updates

Correction and substantive update, 6 November: replaced the earlier headline that framed external estimates as established losses. Arkéa’s opened 4 November statement says amounts remain under assessment, operations were resuming and customer assets were unaffected; the €100m/€118m figures remain attributed, differing estimates.

Substantive update, 8 November: added Arkéa’s follow-up statement identifying use of its account through a third-party service-provider platform. The earlier report that the attack method was unknown is superseded. The bank says customer assets were unaffected; the exact sum, attacker and full recovery remain unknown.

Sources

References support the numbered facts above. Source checks: 8 Nov 2026, 23:02 UTC.

The bank’s 4 November statement is now opened and says the incident was controlled, some transfers were delayed while operations resumed and client assets were unaffected; amounts involved were still under assessment. AFP’s approximate €100 million and OCCRP’s €118 million remain attributed external estimates, not a final bank-confirmed total. The method and actor remain unknown.

  1. French bank says cyberattack stole around €100m

    Agence France-Presse · Reporting · 5 Nov 2026

    Opened AFP report; approximate amount is attributed to the bank.

  2. Hackers steal estimated €118 million in cyberattack on French bank

    Organized Crime and Corruption Reporting Project · Reporting · 5 Nov 2026

    Opened OCCRP report; its estimate differs from AFP’s.

  3. European banks wake up to scale of vulnerability after cyberattack on French bank

    Le Monde · Reporting · 5 Nov 2026

    Opened Le Monde’s account, including the bank’s assurance about customer assets.

  4. Crédit Mutuel Arkéa says it was the victim of an attack

    Crédit Mutuel Arkéa · Primary source · 4 Nov 2026

    Opened the bank’s French-language statement; it says operations were resuming, client assets were not affected and amounts involved remained under assessment.

  5. Additional information following the cyberattack on Crédit Mutuel Arkéa

    Crédit Mutuel Arkéa · Primary source · 4 Nov 2026

    The bank says attackers used a third-party service-provider platform to initiate transfers from an Arkéa account; customer assets were unaffected.

Report a factual error