News Desk · Fraud

French bank Crédit Mutuel Arkéa says cyberattack enabled about €100M in fraudulent transactions

French lender Crédit Mutuel Arkéa said on 4 November 2026 that a cyberattack allowed fraudulent transactions of around 100 million euros, a provisional estimate, according to AFP. The bank said clients did not lose money, and AFP reported that the Paris prosecutor's office had opened an investigation.

Developing storyFraudFrance4 Nov 20262 min readUpdated 5 Nov 2026

Crédit Mutuel Arkéa, a French lender, said it was the victim of a cyberattack that allowed fraudulent transactions to be carried out, according to Bloomberg and AFP. In a statement on 4 November 2026, the bank put the amount at around 100 million euros, according to AFP. The bank said this was a provisional estimate and that the amount was still being evaluated. The bank said its own teams detected the attack, according to AFP and Euronews.

According to the bank's statement as reported by AFP, the attackers gained access to the bank's own account and used it to make transfers to other banks. The bank said the stolen funds were then converted into crypto assets on specialised platforms, according to AFP. The bank said client accounts were not used and clients did not suffer losses. It said part of the funds had been blocked and that it was working to recover the rest, AFP reported. The bank said it had ruled out human error and described a sophisticated attack from outside.

As a precaution, the bank temporarily suspended some transactions to secure its operations, according to AFP, Bloomberg and Euronews. The Paris prosecutor's office opened an investigation into a suspected attack on an automated data processing system by an organised group, the French offence that covers computer hacking, AFP reported.

No prosecutor, police force or regulator had published its own statement on the attack when this story was updated. This account is based on the bank's statements and the prosecutor's comments as reported by AFP, Bloomberg and Euronews. AMLift will update it as official information appears.

Developing story. This account is based on reporting by established news organisations and on statements by the parties involved, as listed in the sources below. No regulator, court or government agency had published an official statement when it was written. Claims are attributed to the people or firms who made them, and the story will be updated as official information is released.

Why it matters to AML professionals

When a bank suffers a cyber theft, the stolen money still has to leave through payment channels and be laundered. AML professionals at receiving banks, payment firms and crypto exchanges are often the ones who can spot and freeze those funds. Fast information sharing between institutions matters most in the first hours after a theft is detected.

Red flags in this case

Large, unusual outbound payments from a bank's own or operational accounts to new beneficiaries
Newly opened accounts at exchanges or payment firms receiving large inbound transfers soon after opening
Incoming funds quickly converted into crypto assets and moved on through several accounts
Payments that break a firm's normal pattern for size, timing or destination

If this landed in your queue

Check whether any of your customers received funds linked to the reported attack or to related public alerts
Place holds where your procedures allow and contact the sending institution through official channels
Review newly opened accounts with large inbound transfers for signs of mule activity
Document everything and escalate for a SAR (suspicious activity report) or local equivalent

Key terms

Fraudulent transaction: A payment made without proper authorisation, for example by someone who has gained unauthorised access to systems.
Money mule account: An account used to receive and pass on stolen funds, often opened or controlled for criminals.

Interview angle

Your bank receives a large transfer that may come from a theft at another bank. What do you do?

Explain how you would check the transfer against alerts, consider a hold under your procedures, contact the sending bank through official channels, review the receiving account for mule signs and escalate for a SAR.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.

Follow on LinkedIn

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.