Crédit Mutuel Arkéa Hit by Third-Party Breach and Estimated €118 Million Theft

Crédit Mutuel Arkéa confirmed that attackers accessed its systems through a third-party service provider’s platform and made unauthorized transfers from the bank’s own accounts. Reported loss estimates were approximately €118 million, or $132 million–$133 million; the bank confirmed the order of magnitude but not an exact amount and said some funds had been blocked. The money was transferred to external banks, with possible subsequent conversion into cryptocurrency remaining unconfirmed. The bank said customer assets and data were unaffected, its Fortuneo online banking arm was not the entry point, and the incident did not threaten its financial stability.

The French cooperative banking group said it contained the breach, strengthened security measures and largely restored normal operations the following morning after precautionary transaction suspensions delayed some customer transfers. It is working with police, judicial authorities and supervisory bodies to investigate the attack and recover funds. While the investigation continues, the bank warned its 5.8 million members of heightened phishing risks.