Credit Mutuel Arkea Says Hackers Stole €100 Million in Rare Attack on French Bank

French banking group Crédit Mutuel Arkea said hackers stole approximately €100 million ($112.61 million) through fraudulent transactions, in an unusual cyberattack that has prompted a criminal investigation and renewed concerns about the vulnerability of financial institutions to sophisticated digital threats.

The Brittany-based lender said on Wednesday that attackers used an account belonging to the bank to execute the transactions. It confirmed on Thursday that the stolen funds were not cryptocurrency, although they could have been converted into digital assets after the theft.

The bank said it was working to recover the money but did not disclose how the attackers gained access to the account or identify the third-party service provider whose platform was used in the operation.

Credit Mutuel Arkea temporarily suspended some transactions as a precaution, causing delays to certain transfers. It said customer assets were not affected.

The bank also rejected media reports that its online banking subsidiary, Fortuneo, had provided the entry point for the attack. A spokesperson said neither Fortuneo nor its customers' accounts were involved.

The incident is unusual because cybercriminals appear to have successfully extracted money directly from a mainstream banking institution, rather than stealing customer credentials or targeting cryptocurrency platforms. Cybersecurity experts told Reuters that attacks against financial institutions are common, but successful thefts from banks themselves are far less frequent.

Rafay Baloch, chief executive of cybersecurity and security engineering firm RedSecLabs, described the incident as unprecedented in Europe.

"We're seeing a lot of these sophisticated attacks targeted at the application layer and sophisticated social engineering attacks being targeted at banking institutions," he said.

Application-layer attacks target vulnerabilities in the software and systems that support digital services, while social engineering involves manipulating employees or other individuals into providing access or sensitive information. The bank has not established publicly which method was used in this case.

The Paris prosecutor's office said its cybercrime unit received a complaint from Crédit Mutuel Arkea on Wednesday and immediately opened an investigation. France's cybercrime police are leading the inquiry.

The bank said it had notified the European Central Bank, French banking supervisors and prosecutors. Its spokesperson declined to identify the third-party service provider involved in the attack, while France's banking regulator, the ACPR, declined to comment.

The investigation will need to establish how the attackers accessed the account, how the fraudulent transactions were authorized and whether weaknesses in a third-party platform contributed to the breach. The amount stolen also raises questions about the controls governing large-value transactions and the speed with which suspicious activity can be detected and stopped.

Puneet Kakkar, managing director at Nardello & Co in Paris, said successful attacks against large financial institutions were rare but carried significant implications for the wider financial system.

"Any time you have a hit in the financial system, it's a big deal," he said.

Kakkar said French banks generally maintained strong cybersecurity because of regulatory requirements, but warned that criminal groups were adapting their methods.

"Cybercriminals are becoming more opportunistic and more creative," he said.

The attack comes amid growing concern among financial regulators about cyber risks, especially as artificial intelligence expands the capabilities available to both security teams and malicious actors. AI tools can potentially accelerate the identification of software vulnerabilities, automate parts of an attack and make fraudulent communications more convincing. However, authorities have not linked the Credit Mutuel Arkea incident to the use of AI.

Credit Mutuel Arkea is a French cooperative banking group with more than 5.8 million customers and €211.5 billion in assets. It belongs to the wider Crédit Mutuel banking network and is affiliated with its central body, while retaining significant strategic autonomy.

The scale of the reported theft makes the incident notable within a sector where cybersecurity breaches more commonly involve stolen customer information, payment-card details or disruption to banking services. A successful transfer of funds from an account belonging to the bank presents a different category of risk because it involves the institution's own financial operations.

The episode also underpins the potential exposure created by third-party technology providers. Banks rely on external platforms and service companies for parts of their digital infrastructure, payments processing and other operations. A weakness in one of these systems can create an entry point beyond the institution's directly managed networks. The precise role of the unnamed provider in this case remains under investigation.

There have been major examples of cybercriminals stealing money from financial institutions in previous years. In 2016, attackers stole $81 million from an account belonging to Bangladesh's central bank at the Federal Reserve Bank of New York. Millions of dollars have also been stolen from banks in Russia and India through cyberattacks, according to a Reuters report.

Nevertheless, the Bangladesh case demonstrated how weaknesses in payment messaging and international transfer processes could be exploited to move funds across borders. The Credit Mutuel Arkea incident adds to the record of attacks in which criminals have sought to access financial institutions' own accounts rather than limit their operations to customer-facing services.