The Credit Mutuel Arkea cyberattack was announced by the French banking group itself on 4 November 2026. Arkéa says attackers carried out fraudulent operations, that customer assets are not affected, and that the incident is contained. This page sets out what the bank says, what it has not yet said, and what customers and other banks can do.
What Does Arkéa Say About the Credit Mutuel Arkea Cyberattack?
Arkéa’s press release of 4 November says the group was the victim of an attack that allowed fraudulent operations. It says it informed the competent and supervisory bodies, and that it temporarily suspended certain transactions as a precaution. It calls the incident closed and under control.
A follow-up Q&A the same day gives more detail. Arkéa says the attackers used the bank’s own account to send transfers to other banks, which may then have let them convert the money into cryptocurrency through specialised platforms. The attackers did not go through customer accounts of its federations or subsidiaries.
Arkéa also says the attackers reached it through the platform of one of its service providers, and that no entry was made through its subsidiary Fortuneo. It describes a sophisticated external attack and says it was not caused by human error. It names no provider and no attacker.
How Much Money Is Involved?
Arkéa has not published a final amount. In the Q&A it says it does not confirm a specific figure put to it and can only validate the order of magnitude. It adds that part of the funds may have been blocked and that other actions are under way to recover the rest.
The bank states that the amounts at stake do not call into question the group’s financial health or solidity. Its press release describes the impacted amounts as still being assessed.
- Announced.
- Press release of 4 November 2026, with a Q&A the same day.
- What happened.
- Fraudulent operations; attackers used the group’s own account to send transfers to other banks.
- Entry point.
- The platform of a service provider, which Arkéa does not name; not through Fortuneo, per Arkéa.
- Customers.
- No consequence on their assets; only a deferred execution of certain transfer operations.
- Status.
- Incident described as closed and under control; most operations resumed on the morning of 4 November.
- Amount.
- Not final; Arkéa says it can only validate the order of magnitude of a figure put to it.
What Should Customers Do After the Attack?
Arkéa says phishing attempts are possible after this attack. It asks customers to be very vigilant and never to share an identifier, password, card number or SMS validation code. If in doubt about a message, it says to contact your bank adviser directly.
Our advice adds one habit: do not use a link or phone number inside a message that mentions the attack. Open your bank’s app or type its address yourself, as you would after any phishing warning, and call the number printed on your card or on the official site.
What Can Other Banks and Finance Teams Take From It?
These steps are our reading of the incident, not Arkéa’s guidance. The reported path matters: a provider platform, then the bank’s own account, then transfers out. Our page on supplier access in the Bybit theft covers the same kind of path, and our overview of cyberattack types against financial firms gives the wider context.
- Map provider accessList every provider platform that can initiate or approve payments from your own accounts, and who at the provider can use it.
- Limit own-account transfersSet tight limits and a second approver on transfers from the bank’s own accounts to other banks.
- Alert on new beneficiariesAlert on first-time beneficiaries and on bursts of outgoing transfers outside normal hours.
- Rehearse a payment freezeAgree who can suspend outgoing transfers, and test how fast the freeze takes effect.
- Prepare recall requestsKeep contacts at partner banks ready, so a recall request can go out within minutes of a fraud alert.