French Bank Says Cyberattack Enabled About €100 Million in Fraudulent Transfers

French banking group Crédit Mutuel Arkéa says a sophisticated cyberattack enabled fraudulent transfers involving roughly €100 million, or about $112 million, before its systems detected and contained the activity.

The breach is unusually striking not only because of its scale, but because of the route the attackers allegedly used. Arkéa said the intruders did not enter individual customer accounts. Instead, they gained access to the bank itself and used an Arkéa account to send money to other financial institutions, where some of the funds were converted into cryptocurrency.

What the bank says happened

In a statement released Wednesday, Crédit Mutuel Arkéa confirmed that a cyberattack allowed fraudulent transactions to be carried out. It temporarily suspended some transfers as a precaution while security teams investigated and added safeguards.

“This incident has been resolved and is now under control,” the bank said. Operations were gradually resuming after technical checks, and Arkéa said customer assets had not been affected. Some routine transfers were delayed during the response.

Agence France-Presse reported that the fraudulent transactions amounted to approximately €100 million. Arkéa said the final amount was still being evaluated and declined to validate a higher estimate of $133 million reported elsewhere, though it acknowledged the general order of magnitude.

Funds were routed toward cryptocurrency

According to the bank, the attackers moved funds to accounts at other banks and then converted some of the money into cryptocurrency through specialized platforms. A portion of those cryptocurrency assets has been frozen, and recovery efforts are continuing.

Recorded Future News reported that Arkéa traced the access route to the platform of an unnamed service provider. The bank described the event as an external, sophisticated attack rather than an employee mistake. It has not publicly identified the supplier, the attackers or the specific vulnerability that allowed access.

Those unknowns matter. Without a technical report, it is not yet possible to determine whether the incident involved stolen credentials, a software flaw, manipulation of a third-party connection or another method. Arkéa also has not said exactly how long the unauthorized access lasted.

Customers were not the source of the stolen money

Arkéa emphasized that the attackers did not drain money from personal or business customer accounts. The fraudulent transfers originated from an account belonging to the banking group, according to the disclosures. The bank said clients would not bear the loss and that their assets remained protected.

The distinction is important for account holders, but it does not make the attack minor. A loss approaching €100 million would be substantial, and the incident demonstrates how a compromise involving a vendor or institutional payment channel can bypass the type of fraud warnings normally aimed at individual customers.

Arkéa warned customers that criminals could exploit publicity surrounding the attack with phishing messages. It urged users not to disclose passwords, card numbers or SMS verification codes and to contact their bank directly when a message appears suspicious.

French prosecutors open an investigation

The Paris public prosecutor’s office told AFP that it had opened an investigation into an organized-group attack on an automated data-processing system. Arkéa said it notified judicial authorities and financial regulators after detecting the activity.

The bank said the amount involved would not threaten its financial health. Crédit Mutuel Arkéa reported €230 million in net profit for the first half of 2026, according to AFP, although the ultimate financial loss from the cyberattack will depend partly on how much money investigators and cryptocurrency platforms can recover.

A wider surge in high-impact cyberattacks

The disclosure arrives amid a broader increase in attacks against financial institutions, retailers and critical business systems. Reuters reported Thursday that nearly 37,000 software and system vulnerabilities were disclosed during the third quarter of 2026, roughly triple the number from a year earlier.

There is no public evidence that artificial intelligence was used in the Arkéa intrusion. The broader trend nevertheless increases pressure on banks and their vendors to monitor payment systems continuously, restrict access between connected platforms and prepare rapid asset-freezing procedures when money begins moving across multiple institutions.

For now, Arkéa says the immediate breach is contained. The larger questions—who carried it out, how the supplier platform was compromised and how much money will ultimately be recovered—remain unresolved.