Summary
- Environment: Service-provider platform and bank transfer operations
- Operational impact: Transfers delayed; most operations resumed November 4
- Financial impact: Final loss and recovered funds not quantified
- Record status: Developing record. Reviewed November 7, 2026; updated as evidence emerges.
What happened
Crédit Mutuel Arkéa said an attacker entered through an unnamed service-provider platform and initiated transfers from an account belonging to the bank. The bank said customer accounts and assets were unaffected. [1]
Impact
The bank temporarily suspended some transactions, delaying transfers, and said most operations had resumed by the morning of November 4 after security checks. [1]
Timeline
Bank discloses attack and partial operational recovery
Arkéa described unauthorized transfers of bank funds and said most operations had resumed that morning. Source account.
[1]Briefing updated
This briefing was last reviewed and updated on November 7, 2026.
Threat Group & Attack Vector
Arkéa identified an unnamed service-provider platform as the entry point. The detailed exploit and attacker identity remain undisclosed. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Arkéa said the attack was contained, authorities and regulators were informed, and recovery of transferred funds was underway. It did not confirm a finalized loss or the reported €118 million amount. [1]