Crédit Mutuel Arkéa’s assurance that its customers’ assets were untouched is important, but it is not the end of the story. The bank has confirmed that attackers diverted money from its own account; it has not yet publicly established the final loss, the complete route into its systems, or how much can be recovered.
Arkéa said on 4 November that it had suffered a “sophisticated” external attack. According to the bank, the attackers used its own account to make transfers to other banking actors, rather than drawing on accounts held by customers of its federations or subsidiaries. It says the incident caused no effect on customer holdings, although some transfer operations were delayed while checks and strengthened safeguards were put in place. [Franceinfo](https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/des-millions-d-euros-voles-une-attaque-inedite-et-une-enquete-ouverte-ce-que-l-on-sait-du-piratage-du-credit-mutuel-arkea_8269124.html)
That distinction matters. A theft from a bank’s own funds is not the same as a loss from customers’ deposits. It is reasonable for Arkéa to prioritise restoring operations and to warn customers about opportunistic phishing attempts. The bank says it detected suspicious activity quickly and that it has contained the incident.
But the bank’s claim of containment is not a complete public accounting. Reports have cited €118 million, while Arkéa has declined to confirm that figure and says only that the scale is in the tens of millions of euros. It says some funds may have been blocked and other recovery work is continuing. France 24 reported that the Paris prosecutor’s office opened an investigation and that the money was reportedly converted through cryptocurrency platforms. [France 24](https://www.france24.com/fr/vid%C3%A9o/20261105-france-la-banque-cr%C3%A9dit-mutuel-ark%C3%A9a-victime-d-une-cyberattaque)
The strongest counterargument is clear: if clients’ assets were not touched and almost all transfer operations resumed on Wednesday morning, the operational impact may have been limited. Yet that does not settle whether data were exposed, how a provider platform was used to reach Arkéa, or whether recovery will materially reduce the loss. Those are the next facts Arkéa and investigators need to establish.
Sources
- franceinfo Tous titres · Source date: 2026-11-05
- France 24 Tous titres · Source date: 2026-11-05
- France 24 Tous titres · Source date: 2026-11-05
Independent editorial content. WUA is not affiliated with any political party. 2026-11-05