France opens cyberattack inquiry into €100m Crédit Mutuel Arkéa theft

French prosecutors have opened an investigation into a cyberattack that let hackers move money out of Crédit Mutuel Arkéa's own accounts, a theft the Brittany-based banking group has put at roughly €100 million without confirming the figure.

The Paris prosecutor's office said it opened the inquiry on 4 November after the bank lodged a complaint. RFI reported that the case is with France's specialist cybercrime police unit, OFAC, and centres on suspected hacking by an organised criminal group.

Crédit Mutuel Arkéa, headquartered near Brest, said the attackers reached its systems through the platform of an outside service provider and used that access to start fraudulent transfers from the bank to other financial institutions. Some of the money may since have been converted into cryptocurrency on trading platforms, which would make it harder to trace and recover.

The group said its online banking subsidiary Fortuneo was not the entry point and that no customer accounts were used to make the transfers. It ruled out human error inside the bank and described the incident as a sophisticated external attack.

Le Télégramme, the regional newspaper, and the cryptocurrency publication CoinDesk reported that as much as €118 million had been diverted, a sum Euronews put at $133 million. The bank declined to confirm the number but said it reflected the approximate scale of the loss, and that some of the money had already been blocked while it works to recover the rest.

"Our teams are continuing their work to precisely assess the financial consequences of this attack. It is still too early to give a final figure," a bank spokesperson said.

The bank said its security systems detected the suspicious activity quickly, allowing it to contain the attack and temporarily suspend certain transfers. Almost all operations had resumed by Wednesday morning.

"This incident has had no impact on customer assets and has only caused a delay in the execution of certain transfers," the bank said.

No group has publicly claimed the attack, and the bank has given no information on who was responsible or what their motive may have been.

Crédit Mutuel Arkéa serves 5.8 million customers and manages more than €211 billion in assets. It reported net profit of €230 million in the first half of 2026.

According to Euronews, the fraud was first made public by ZachXBT, an independent investigator who tracks cryptocurrency transactions. Citing AFP, Euronews reported that ZachXBT said the stolen funds had been routed through multiple accounts on cryptocurrency exchanges. RFI did not carry that detail.

The bank has urged customers to watch for phishing attempts that exploit publicity around the incident. It has not said whether any customer data was compromised.