---
title: Crédit Mutuel Arkéa says attackers came in through a service provider's platform and used the bank's own account; it calls the $133M figure the right order of magnitude | ctxsec
url: https://ctxsec.com/items/credit-mutuel-arkea-faq-service-provider-platform-entry-own-account-paris-probe
description: "In a follow-up FAQ to its Nov 4 disclosure, Cr\u00e9dit Mutuel Ark\u00e9a says the attackers reached the bank directly through the platform of one of its service providers, not through its online bank Fortuneo as some press reported. They used the bank's own account to send transfers to other banks, which then likely let them convert the money to cryptocurrency; no customer accounts in its federations or subsidiaries were used. Asked about the reported \u20ac118M ($133M), the bank says it does not confirm the figure but can 'validate the order of magnitude'; part of the funds was blocked and recovery is under way. Ark\u00e9a rules out internal human error and calls it a sophisticated external attack. Per AFP, the Paris prosecutor's cybercrime section opened an investigation for organized-gang intrusion into an automated data system, handled by France's anti-cybercrime office (OFAC). The provider has not been named."
status: "official (Crédit Mutuel Arkéa FAQ, Nov 4); Paris prosecutor cybercrime probe per AFP via 01net; provider unnamed; final loss not disclosed"
published: 2026-11-08
---

> In a follow-up FAQ to its Nov 4 disclosure, Crédit Mutuel Arkéa says the attackers reached the bank directly through the platform of one of its service providers, not through its online bank Fortuneo as some press reported. They used the bank's own account to send transfers to other banks, which then likely let them convert the money to cryptocurrency; no customer accounts in its federations or subsidiaries were used. Asked about the reported €118M ($133M), the bank says it does not confirm the figure but can 'validate the order of magnitude'; part of the funds was blocked and recovery is under way. Arkéa rules out internal human error and calls it a sophisticated external attack. Per AFP, the Paris prosecutor's cybercrime section opened an investigation for organized-gang intrusion into an automated data system, handled by France's anti-cybercrime office (OFAC). The provider has not been named.

[← Cybersecurity News](/news) · [markdown](/items/credit-mutuel-arkea-faq-service-provider-platform-entry-own-account-paris-probe.md)

official (Crédit Mutuel Arkéa FAQ, Nov 4); Paris prosecutor cybercrime probe per AFP via 01net; provider unnamed; final loss not disclosed

2026-11-08

### Crédit Mutuel Arkéa says attackers came in through a service provider's platform and used the bank's own account; it calls the $133M figure the right order of magnitude

- **Entry point:** a third-party provider's platform (unnamed), not Fortuneo.
- **Money path:** transfers from the bank's own account to other banks, then to crypto platforms; on-chain tracing earlier showed swaps to ETH and Monero.
- **For banks and fintechs:** inventory which providers can initiate or approve payments from treasury or nostro accounts, require out-of-band confirmation for large outbound transfers to new counterparties, and test how fast you can freeze outbound rails.

See our [Nov 4 item](/items/credit-mutuel-arkea-confirms-cyberattack-fraudulent-operations-nov-4) for the original disclosure.

Sources: [Crédit Mutuel Arkéa: Informations complémentaires suite à l'attaque (Nov 4, French)](https://www.cm-arkea.com/arkea/banque/assurances/pa_38386/fr/informations-complementaires-suite-a-l-attaque-dont-le-credit-mutuel-arkea-a-ete-victime) · [01net: un prestataire piraté, enquête du parquet de Paris (French)](https://www.01net.com/actualites/cyberattaque-du-credit-mutuel-arkea-un-prestataire-pirate-des-millions-blanchis-en-crypto-tout-ce-que-lon-sait-sur-lenquete-en-cours.html) · [SecurityAffairs: attackers exploit third-party provider to raid Crédit Mutuel Arkéa (Nov 8)](https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html)