Crédit Mutuel Arkéa details cyberattack and fund recovery

Crédit Mutuel Arkéa has confirmed attackers used the bank's own account to route fraudulent transfers to other financial institutions.

The attackers accessed the bank through a service provider's platform, not through Fortuneo or customer accounts.

“This was a sophisticated attack from outside, which has now been contained,” Crédit Mutuel Arkéa said in a statement.

The bank declined to confirm reports of €118 million in stolen funds, but acknowledged losses of a similar order.

Some affected funds have been blocked, while the bank continues efforts to recover the remaining money.

The fraudulent transfers may have enabled attackers to convert the money into cryptocurrency through specialised platforms.

Crédit Mutuel Arkéa said customer assets were unaffected, although certain transfers faced delays before operations resumed.

The incident highlights the financial and operational risks banks face when attackers exploit third-party service providers.