Crédit Mutuel Arkéa says attackers used its own account via a supplier, and accepts the €118m scale

Half a half year's profit, and an order of magnitude the bank will accept

The figure put to Crédit Mutuel Arkéa was 118 million euros, or 133 million dollars. The French banking group's answer, in its own English version of a notice issued at 17:30 Brest time on Wednesday 4 November 2026, was that it does "not confirm this information and can only validate the order of magnitude". Set against the bank's own accounts, 118 million euros is 51 per cent of the 230 million euros of net profit it reported for the first half of 2026, about 1.1 per cent of its 11.2 billion euros of prudential own funds, and about 0.06 per cent of its total assets of 211.5 billion euros (all three derived, from its results release of 7 September 2026).

Those ratios check one claim, and only one. The bank says the amounts involved are "absolutely not of a nature" (French: absolument pas de nature) to undermine its financial health and soundness, and on its own figures that is plausible. They do not establish the loss. The 118 million euros is not the bank's number: it says part of the funds has been blocked, other actions are under way to recover the rest, and it is "still too early to communicate a final amount". The 133 million dollar estimate came from outside, from a pseudonymous blockchain investigator, according to The Record. An order of magnitude is a loose thing to accept: it endorses the scale, not the sum.

This briefing reads the bank's two notices of 4 November, in French and in the bank's own English versions, and its half year results release, all saved from the bank's site between 21:18 and 21:24 UTC on Wednesday 4 November 2026. The Record's report of the same evening is used only for what it alone says, and is labelled wherever it is used. The investigator's posts on X were not read. The French press reports about Fortuneo that the bank disputes were not read either.

What the bank says happened, in its own words

The bank published twice. A first notice at 13:00 Brest time (12:00 UTC, derived: France is one hour ahead of UTC in November) announced "an attack that enabled fraudulent transactions to be carried out" (French: une attaque ayant permis la réalisation d'opérations frauduleuses). A second, at 17:30, answered seven questions the press had sent. The table sets the bank's French beside its own English version, so no wording here is this site's translation unless it says so.

Crédit Mutuel Arkéa's notices of 4 November 2026 (13:00 and 17:30, Brest), French as printed beside the bank's own English version. Saved from cm-arkea.com and read in full.

Point	French, as printed	The bank's English version
Route in	Les attaquants sont passés par la plateforme d'un de nos prestataires	The attackers went through the platform of one of our service providers
The account	Les attaquants ont utilisé le compte propre de Crédit Mutuel Arkéa	The attackers used Crédit Mutuel Arkéa's own account
Where it went	pour réaliser des transactions vers d'autres acteurs bancaires	to carry out transactions to other banks
Cryptocurrency	qui leur ont ensuite potentiellement permis de convertir cet argent en crypto monnaie via des plateformes spécialisées	which may then have enabled them to convert the money into cryptocurrency via specialised platforms
Customers	Ils ne sont donc pas passés par des comptes de clients de ses fédérations ni de ses filiales.	They therefore did not go through the accounts of customers of its federations or subsidiaries.
Fortuneo	aucune "entrée" ne s'est faite par Fortuneo	there was no "entry" through Fortuneo
Recovery	une partie des fonds concernés a pu être bloquée	part of the funds concerned has been blocked
Cause	une attaque sophistiquée venant de l'extérieur	a sophisticated attack from outside
Detection	Nos dispositifs de sécurité ont permis d'identifier très rapidement les activités suspectes	Our security systems made it possible to identify the suspicious activity very quickly

Two words carry more than they seem to. "Potentiellement" makes the conversion to cryptocurrency a possibility in the bank's own telling, not an established step. And "acteurs bancaires" is broader than the English "banks": literally "banking players" (this site's translation), which could take in payment firms as well as banks. The bank does not say which.

Zoom

To stop further movements, the group says it "temporarily" suspended certain transactions as a precaution. The only effect on customers it names is "a delay in the execution of certain transfers". Almost all operations resumed during the morning of 4 November, the 17:30 notice says, after the group and its subsidiaries completed checks and put enhanced security measures in place. It also says that, as soon as the attack was detected, it contacted "the relevant authorities and supervisory bodies", and that its teams are working with "the competent judicial and law-enforcement authorities" to determine the origin of the attack and its modus operandi. Neither notice names a single one of those bodies.

Stated, and not stated

"Not stated" means not found in either notice, read in full in both languages. It does not mean the information does not exist, and some of it may come later: the bank says it will update as new information becomes available.

What Crédit Mutuel Arkéa's two notices of 4 November 2026 state, and what they do not. Read between 21:18 and 21:24 UTC on Wednesday 4 November 2026.

Question	What the bank states	Not stated
When did it start, and when was it found?	Suspicious activity identified "very quickly"; measures taken "as soon as" it was detected.	Any date or time for the start, the detection or the containment.
How long did it run?	"Now under control". The 13:00 notice also calls it "clos" (closed, this site's translation).	A duration. Only The Record reports that it ran over several days.
Which supplier?	"One of our service providers", and its "platform".	The name, what the provider does for the bank, and how its platform was entered.
How did a supplier's platform reach the bank's money?	The attackers "reached Crédit Mutuel Arkéa directly".	Whether the platform could initiate or approve payments, and what access was used.
What moved, and where to?	Transactions from the group's own account to other banks, possibly converted to cryptocurrency.	How many transactions, which payment system, which banks or platforms received them.
How much?	Validates the order of magnitude of 118 million euros, without confirming it. Part of the funds blocked.	The final loss, how much was blocked, where and by whom.
Who was told?	"The relevant authorities and supervisory bodies"; judicial and law enforcement authorities.	Which ones. No supervisor, agency, police force or prosecutor is named.
Who did it?	An attack "from outside", and not human error at Arkéa.	Any attribution, and any link to another incident.
Customer data?	Phishing is common after attacks "of this nature"; the warning is "preventive".	A yes or no. Asked directly whether customer data was compromised, the bank does not say either way.
Technical detail?	None.	No indicators, addresses, wallets or other artifacts, so this briefing has no technical details section.

Very quickly, or over several days?

The bank says its security systems identified the suspicious activity "very quickly". The Record reports that the investigator who first made the theft public, on Monday 2 November (derived from The Record's "on Monday" and its date of 4 November), estimated it from exchange withdrawals and laundering transactions and said the attack had run over several days. The bank's first notice came on the Wednesday, two days after that outside report (derived).

The two accounts are not reconciled on the record. Without a start time and a detection time, a reader cannot tell whether "very quickly" is measured from the first fraudulent transfer or from some later point after several days of them (inference). Nor do the notices say whether the bank found the activity itself or learned of it from outside. That is the single most useful fact the bank could add, and it is the one a supervisor will ask for first.

The sequence as far as the record goes. Times are as printed; UTC conversions and the Monday date are derived.

When	What	Source
Not stated	The attack begins, and is detected	Neither the bank nor The Record
Monday 2 November 2026 (derived)	First public report, by a pseudonymous blockchain investigator, who later named Arkéa and estimated more than 133 million dollars	The Record
Morning of 4 November	Operations gradually resume after a precautionary suspension of certain transactions	The bank
4 November, 13:00 Brest (12:00 UTC)	First notice: an attack, fraudulent transactions, customer assets not affected	The bank
4 November, 17:30 Brest (16:30 UTC)	Second notice: seven answers, including the supplier's platform and the own account	The bank
4 November, 19:01 UTC	The Record publishes its report	The Record's page data

The friendly name check

Labels do work in this story, in both directions. None of them is a control, and none of them tells a reader how the money left.

Labels used about the incident, who uses them, and what the record behind them shows.

The label	Who uses it	What the record shows
"Heist"	The Record's headline	The bank's words are an attack and fraudulent transactions. Neither says how the transfers were made.
"Sophisticated attack from outside"	The bank	Asserted, not shown. No method is described. The phrase answers a question about human error rather than describing a technique.
Not human error	The bank	Rules out human error at Arkéa. It says nothing about the supplier, or about the controls on the bank's own account.
"Closed and under control"	The 13:00 notice (clos et maîtrisé, this site's translation)	The same notice says the amounts are "still being assessed".
No impact on customers' assets	Both notices	A statement about customer accounts, and consistent with the bank's account of the route. The money came from the group's own account, so whatever is not recovered is the group's loss.

The bank has an interest in reassuring customers and markets, and both notices are written to do so: the subtitle of the first is that the incident is contained and customers' assets are not affected. That does not make them wrong. It is a reason to read them for what they state rather than for their tone. The bank's disputed point with the French press is also narrow: it denies any "entry" through Fortuneo, its online bank, and the home page of Fortuneo carried no incident notice of its own when this site read it.

What to do, in the order worth doing

The first two items are for the bank's customers and repeat what the bank itself says, with this site's additions labelled. The rest are this site's suggestions for anyone who runs payments, and they describe what to check, not how the attack was done.

What could not be verified

• The loss. 118 million euros and 133 million dollars are figures put to the bank, which validates only their order of magnitude. The final amount and the amount blocked are not stated.
• The duration and the first report. That the attack ran over several days, and that it was first reported on Monday, rest on The Record's account of an investigator's posts on X, which were not read.
• The Fortuneo reports. The French media reports the bank disputes were not read; the bank's denial is quoted as printed.
• A figure in The Record. The Record gives the group's total assets as above 237 billion pounds, citing its latest annual report. The bank's own notices and results give 211.5 billion euros, which this briefing uses. The annual report was not read.
• Time stamped. Read between 21:18 and 21:24 UTC on Wednesday 4 November 2026. The bank says it will communicate as new information becomes available, so any line above may be overtaken.

The question the notices leave open

Crédit Mutuel Arkéa says the attackers came through a supplier's platform, reached the bank directly and used its own account, and that it spotted them very quickly. Its notices name no supplier, no date and no control that failed. The question for any bank reading them is its own: which of your suppliers' platforms can move money out of your own accounts, and would anyone notice before the transfers had run for days?

Key facts