{
  "id": "arkea-banking-fraud",
  "url": "https://ohshit.app/incidents/arkea-banking-fraud/",
  "title": "Crédit Mutuel Arkéa confirms cyberattack and fraudulent transactions; transfers resume progressively",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-04",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Arkéa",
    "banking",
    "fraud"
  ],
  "ecosystems": [],
  "summary": "Crédit Mutuel Arkéa confirms a cyberattack enabled fraudulent transactions. It temporarily suspended some transactions and now reports progressive resumption after security checks. The bank says customer holdings are unaffected; the amount remains under assessment. Entry point and links to reported crypto flows are unconfirmed.",
  "splash": "Crédit Mutuel Arkéa customers with delayed transfers; exact affected systems, subsidiaries and customer count are not disclosed.",
  "wipe": "Verify pending transfers through your usual bank channel and contact your adviser about suspicious messages or account activity.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify delayed transfers through your established banking channel",
      "hint": "Open your usual banking app/site or contact your established adviser. Ask about the status of a specific delayed transfer before submitting it again; the bank says some transfers were delayed and operations are resuming progressively. Preserve references and timestamps and follow your bank’s instructions rather than assuming every operation is restored."
    },
    {
      "title": "Verify messages with your adviser before responding",
      "hint": "The bank warns that phishing may exploit the incident. Do not disclose identifiers, passwords, card numbers or SMS approval codes in response to unexpected messages. Contact your adviser through an existing number or the normal app, not a link or number in the message."
    },
    {
      "title": "Report suspicious account activity and retain evidence",
      "hint": "Review account activity through your normal banking channel and promptly ask the bank about transactions you do not recognize. Keep the notice, transaction reference, amount and time for your adviser. The bank’s customer-protection statement is not an independent reconciliation of every account; do not send a crypto payment or share a wallet recovery phrase to purported recovery agents."
    }
  ],
  "sources": [
    {
      "name": "Crédit Mutuel Arkéa original company release via Actusnews Wire",
      "url": "https://www.actusnews.com/fr/credit-mutuel-arkea/cp/2026/11/04/credit-mutuel-arkea-annonce-avoir-ete-victime-d_une-cyberattaque",
      "says": "Company-authored regulated release, explicitly attributed to Crédit Mutuel Arkéa; full public text read by ordinary HTTP after the web reader failed. Confirms attack/fraud, temporary transaction suspension, progressive resumption, protected customer holdings, unknown amount and phishing precautions.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The bank’s own November4 release confirms cyberattack-enabled fraudulent transactions.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 4, 2026",
      "title": "Bank confirms fraudulent transactions and reports progressive resumption",
      "body": "Its original company release says some transactions were suspended, authorities and supervisors informed, and operations were resuming after additional checks/security measures. The impact amount remains under assessment; the displayed publication time has no explicit timezone."
    }
  ],
  "body_markdown": "Crédit Mutuel Arkéa’s November 4 company release confirms a cyberattack that enabled fraudulent transactions. It says it contacted competent authorities and supervisors, mobilized its teams and temporarily suspended some transactions. It calls the incident contained/closed and reports progressive operational resumption during the morning after checks and stronger safeguards; its teams continue evaluating consequences and strengthening security. These are the bank’s statements, not an independent forensic conclusion or proof that every transfer has completed.\n\nThe bank says customer holdings across its federations and subsidiaries are unaffected and that some transfers were delayed. It has not disclosed an affected-customer count, detailed attack window, entry point, compromised software version, data-exposure scope or quantified loss. It says the amount is still being assessed and does not threaten the group’s financial strength. The release does not identify Fortuneo as the intrusion point or confirm ownership of wallets cited in earlier crypto reports. Transfers on a blockchain cannot establish this bank’s loss, the source of funds or the attack mechanism; no crypto-flow estimate is adopted here as a bank-confirmed amount.\n\nL4 reflects the bank’s confirmation of real cyber-enabled financial fraud and transaction interruption. Customers have no published software patch to install. Follow the bank’s own service and adviser instructions, continue watching for phishing, and distinguish progressive recovery from completed investigation or independent verification of all balances."
}