French prosecutors investigate €100m cyberattack on Crédit Mutuel banking group

Crédit Mutuel Arkéa suffered a sophisticated cyberattack involving fraudulent transfers from the banking group’s own accounts. French prosecutors opened an investigation after the bank filed a complaint. The incident matters because it struck a major financial institution while leaving customer assets untouched, according to the bank.

The attackers reportedly entered through an external service provider’s platform. They then used access to initiate transfers from Arkéa accounts to other financial institutions. Reports estimated that as much as €118 million was diverted, while the bank described the incident as roughly €100 million and said the final figure remained unclear.

Security systems detected suspicious activity quickly. Arkéa contained the attack, suspended some transfers, and said almost all operations resumed by Wednesday morning. Some money was blocked, and recovery efforts continue. Investigators are examining the access route, the people responsible, and where the funds went.

A cyberattack is an unauthorized action against computer systems, networks, or data. It can steal information, disrupt services, or manipulate financial operations. In this case, the attack mattered because criminals reportedly reached a bank’s internal systems through a connected external provider rather than directly through a customer account.

The article says the attackers gained access through the platform of an external service provider. From there, they initiated transfers from Crédit Mutuel Arkéa’s own account to other financial institutions. The article does not explain the precise weakness, such as stolen credentials or vulnerable software, so the exact entry method remains under investigation.

This type of access makes third-party security important to the whole banking network. Arkéa said Fortuneo was not the entry point and that no customer accounts were accessed. Investigators are seeking to establish how the attackers entered, while the bank continues assessing the damage and recovering funds.

The alleged theft was large because it involved a major banking group’s own funds. Le Télégramme and CoinDesk reported that as much as €118 million had been diverted. Crédit Mutuel Arkéa declined to confirm that exact figure but acknowledged it reflected the approximate scale of the incident.

The bank said some money had already been blocked. It is still working to calculate the final financial impact and recover the remainder. The suspected transfers went from Arkéa’s account to other financial institutions, rather than from individual customer accounts. The bank said customer assets were not affected.

Crédit Mutuel Arkéa serves 5.8 million customers and manages more than €211 billion in assets. It reported a net profit of €230 million in the first half of 2026. These figures help explain why the breach has drawn attention, even though the bank said its financial stability was not at risk.

When stolen bank transfers are converted into cryptocurrency, investigators may face a more complicated recovery process. The article says the money may have moved through specialized cryptocurrency trading platforms. That possibility matters because the funds can leave the ordinary banking channels where the original transfers occurred.

In this case, hackers allegedly transferred money from Crédit Mutuel Arkéa’s own account to other financial institutions. The money may then have been converted into cryptocurrency. The article does not state exactly which assets, platforms, or transactions were involved, so the precise path remains unknown.

The bank said some of the money had already been blocked and that efforts continued to recover the rest. Investigators are trying to determine where the stolen funds were transferred. Any cryptocurrency conversion could complicate that work, while the bank continues assessing the total loss and tracing the money.

France’s specialist cybercrime police unit, OFAC, is investigating the attack for the Paris prosecutor’s office. The case concerns suspected hacking by an organized criminal group. It matters because investigators must reconstruct both the technical breach and the financial movement before identifying those responsible.

Investigators are seeking to establish how the attackers gained access to the bank’s systems. They are also examining who carried out the operation and where the stolen funds were transferred. The suspected route involved an external service provider’s platform, but the article gives no confirmed details about the specific weakness or method used.

The attack has not been publicly claimed. Crédit Mutuel Arkéa has provided no information about the attackers’ identities or possible motives. The bank is still assessing the financial consequences, while investigators work to trace the money and determine whether further recovery is possible.

Interconnected banking networks create more pathways between institutions, services, and technology platforms. Outside providers can support essential operations, but their systems may also become part of a bank’s security boundary. A weakness in one connected service can therefore create risks beyond that provider itself.

The Crédit Mutuel Arkéa attackers reportedly gained access through an external service provider’s platform. They used that access to initiate transfers from the bank’s own account. The article does not identify the provider or explain its technical weakness, but the incident shows why connections must be monitored and protected.

European regulators are increasingly concerned about cyber threats to financial institutions as banks rely more on interconnected systems and external providers. The article also mentions fears that artificial intelligence could enable more sophisticated attacks. Banks must therefore contain suspicious activity quickly and examine third-party access closely.

Banks normally authorize transfers through account permissions, secure credentials, transaction limits, and approval steps. They also monitor payments for unusual amounts, destinations, timing, or behavior. These controls matter because they can pause a transfer while staff or automated systems verify that it is legitimate.

For example, a payment far larger than an account’s normal activity could trigger an alert or require additional approval. Access controls can restrict which employees, applications, or providers may initiate payments. Banks may also suspend transfers when monitoring detects suspicious activity. These are established banking security practices; the article does not provide Arkéa’s complete control list.

In this incident, Arkéa said its security systems quickly detected suspicious activity. The bank temporarily suspended certain transfers and contained the attack. Almost all operations had resumed by Wednesday morning. The case shows that detection and payment suspension can limit damage, even when attackers reach connected systems.