# Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent transactions · pwn.watch

> French regional bank Crédit Mutuel Arkéa said on Nov 4 2026 that it detected a cyberattack which enabled fraudulent transactions. Management temporarily suspended some transactions to secure operations and prevent further fraudulent movements, and said clients would not suffer financial loss. Independent researcher ZachXBT and Le Télégramme reported about €118 million ($133 million) diverted; the bank has not confirmed that figure. AFP and Euronews relayed the bank's confirmation of fraudulent transactions without an official loss amount.

Page: https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026 · generated 2026-11-04T14:30:54.317Z

## Status
- Severity: high · status: live · patch: partial
- Product: Crédit Mutuel Arkéa (banking systems)
- Started: 2026-11-04
- Affected: Crédit Mutuel Arkéa customers during the fraudulent-transaction window (bank says clients are protected from loss)
- Fixed in: Bank says the incident is under control and some transactions were temporarily suspended

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026.json
- This file: https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-04: Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent transactions, temporarily suspends some operations, and says clients will not suffer financial loss. ZachXBT/Le Télégramme cite ~€118M diverted; the bank does not confirm the amount. (https://www.euronews.com/2026/11/04/credit-mutuel-arkea-reports-cyberattack-says-clients-will-be-fully-protected)

## Fix brief
# Security brief: Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent transactions

Source: https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 14:24 UTC

## Patch status
**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**

## What it is
French regional bank Crédit Mutuel Arkéa said on Nov 4 2026 that it detected a cyberattack which enabled fraudulent transactions. Management temporarily suspended some transactions to secure operations and prevent further fraudulent movements, and said clients would not suffer financial loss. Independent researcher ZachXBT and Le Télégramme reported about €118 million ($133 million) diverted; the bank has not confirmed that figure. AFP and Euronews relayed the bank's confirmation of fraudulent transactions without an official loss amount.

Severity detail: Bank-confirmed cyberattack with fraudulent transactions; ~€118M figure from ZachXBT/Le Télégramme is unconfirmed by the bank

- Product: Crédit Mutuel Arkéa (banking systems)

## Affected versions
- Crédit Mutuel Arkéa customers during the fraudulent-transaction window (bank says clients are protected from loss)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Bank says the incident is under control and some transactions were temporarily suspended

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Mitigations
The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Specific notes
Arkéa customers: follow bank notices; the bank says you will not bear the fraudulent losses. Watch for phishing that references the incident.

## Latest updates
- Nov 4, 2026: Crédit Mutuel Arkéa confirms a cyberattack that enabled fraudulent transactions, temporarily suspends some operations, and says clients will not suffer financial loss. ZachXBT/Le Télégramme cite ~€118M diverted; the bank does not confirm the amount.

## Write-ups & news
- [Crédit Mutuel Arkéa reports cyberattack, says clients will be fully protected](https://www.euronews.com/2026/11/04/credit-mutuel-arkea-reports-cyberattack-says-clients-will-be-fully-protected)
- [Le Crédit Mutuel Arkéa victime d'un piratage de plus de 118 millions d'euros](https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php)

---
Machine-readable: https://pwn.watch/i/credit-mutuel-arkea-cyberattack-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.