Credit Mutuel Arkea Targeted in $133 Million Cyberattack

French cooperative banking group Crédit Mutuel Arkéa has suspended selected systems following a cyberattack that enabled fraudulent transactions of up to $133 million. The attacker breached the network directly through a service provider's platform, subsequently using the bank's own account to transfer funds to external banking organisations and convert them into cryptocurrency. Crédit Mutuel Arkéa, which serves more than 5.8 million members, stated that customer assets remain unaffected, though transfer executions were delayed. The institution described the breach as a "sophisticated attack" and confirmed that the financial impact is significant.

Key Facts

How Did Intruders Breach the Network and Transfer Funds?

The attacker gained entry to Crédit Mutuel Arkéa's network directly through a third-party service provider's platform rather than internal human error. Once inside, the intruder used the bank's proprietary account to execute transfers to external banking institutions, converting the stolen capital into USDC and USDT stablecoins across several centralised exchanges.

In an official FAQ page, the French cooperative banking group explained that the intruder compromised its infrastructure via a partner service provider, while clarifying that online banking subsidiary Fortuneo was not involved. Blockchain fraud investigator ZachXBT initially detected the activity on November 2, noting unauthorised withdrawals dating to November 1. ZachXBT warned that the lack of immediate public disclosure enabled the attacker to launder $30 million by November 3, which European law enforcement might otherwise have frozen.

Crédit Mutuel Arkéa ruled out internal human error, classified the intrusion as a sophisticated attack, and confirmed that judicial authorities and the police are investigating the incident.

Were Customer Accounts and Funds Impacted by the Incident?

Customer deposits and accounts were not compromised during the cyberattack. Crédit Mutuel Arkéa confirmed that the perpetrator initiated transactions exclusively through the institution's own operational account. Although customer funds remained safe across all federations and subsidiaries, the incident caused operational delays in executing certain bank transfers whilst specific IT systems were suspended.

The banking group, which manages 211.5 billion euros in assets, formally announced on November 4 that operations were gradually returning to normal and that the incident was "now closed and under control". Although investigator ZachXBT reported that the attacker may have stolen up to 118 million euros ($133 million), the bank declined to confirm the exact figure, stating only that it could validate the order of magnitude and noting that some funds had been blocked.

The bank confirmed that customer assets were unaffected and that fraudulent transactions were restricted entirely to the institution's own accounts.

What Should You Do?

No software update or technical patch is available, as the intrusion involved a service provider platform rather than an end-user software flaw. However, the bank explicitly warned of heightened social engineering risks following the disruption, recommending the following measures:

• Stay alert to phishing communications: Be cautious of unsolicited emails, phone calls, or messages referencing bank transfers or system suspensions designed to extract sensitive account information.
• Avoid sharing confidential credentials: Never disclose passwords, personal identification numbers, or account details via email or telephone requests.
• Verify messages directly with banking advisers: Confirm any unexpected or suspicious communications by contacting your designated bank adviser or official customer support directly.
• Report incidents in Malaysia: Organisations and individuals encountering suspicious digital communications or financial fraud attempts can lodge reports with Cyber999 via MyCERT or contact the National Scam Response Centre at 997.

Common Questions

How much money was stolen in the attack?

Blockchain investigator ZachXBT estimated that the attacker stole up to 118 million euros ($133 million) in USDC and USDT stablecoins. Crédit Mutuel Arkéa declined to confirm the exact sum but validated the order of magnitude, noting that the amount was significant and some funds were successfully blocked.

Were customer deposits or personal accounts affected?

Customer deposits remained completely safe throughout the cyberattack. Crédit Mutuel Arkéa stated that the attacker used the institution's own accounts rather than customer balances to execute unauthorised transactions. The incident resulted only in execution delays for certain outgoing transfer requests whilst security teams contained the breach.

How did the attacker access the bank's systems?

The intruder reached the bank's network directly through a third-party service provider's platform. Crédit Mutuel Arkéa ruled out internal human error as well as its subsidiary Fortuneo, describing the event as a sophisticated attack that is currently being investigated alongside judicial authorities and police.

Sources and Methodology

This news dispatch is based solely on reporting by BleepingComputer published on November 7, 2026 10:25 AM. ROCKSTARmedia Infosec has not independently reviewed, verified, or consulted any secondary documentation, regulatory filings, or external vendor advisories beyond the cited source material.