# Nobody tricked a customer. The bank paid itself out. ID: SA-167 Type: Documented incident Audience / at-risk group: Bank security, payments and fraud teams, companies that give suppliers access to their systems, and anyone who reads 'AI heist' headlines Subject: Crédit Mutuel Arkéa cyberattack, November 2026 Sources checked: 2026-11-14 ## Lesson A supplier breach is your breach until proven otherwise: cut and review every access the supplier had, not just the link you saw. Instant transfers settle before anyone looks, so new beneficiaries and unusual outflows from an institution's own accounts need limits and a human check. And 'AI-enabled' in a headline is a claim, not a finding: the documented mechanism here is old-fashioned access, fake accounts and mule accounts opened in advance. ## Source findings Crédit Mutuel Arkéa announced on 4 November 2026 that a 'sophisticated attack coming from the outside' had caused fraudulent transfers of around €100 million from its own account to other banks, that the attack was contained and that clients suffered no losses (AFP). The Paris prosecutor opened an investigation into an attack on an automated data processing system by an organised group. Le Télégramme reported a higher figure (133 million), which the bank did not confirm. In an AFP interview on 13 November, reported by Silicon.fr and INCYBER, chair Julien Carmona described the timeline: supplier compromise detected on 27 October; fake Fortuneo IBANs used from 1 November to trigger payment orders from the bank's own account; instant transfers to real accounts at other European banks, then crypto platforms; discovery of the scale on 3 November. He put the loss at about €100 million, around 1% of the group's equity, said part of the money had been recovered or frozen, called the attack unprecedented in sophistication and 'very probably' assisted by advanced artificial intelligence, and said the perpetrators are unknown. ## Limits This case rests on the bank's own statements and press reporting; no court has ruled and the perpetrators are unidentified. The role of artificial intelligence is the chair's assessment ('very probably'), and none of the sources publishes evidence of what, if anything, AI did; the headline figure of $110 million is a currency conversion of about €100 million, and the gross amount diverted may be higher. It is not public how the supplier was breached or how the fake IBANs were accepted. Nothing here suggests that Fortuneo or Crédit Mutuel Arkéa customers lost money; they were not the targets. ## Sources - [Silicon.fr (from the chair's AFP interview)](https://www.silicon.fr/cybersecurite-1371/credit-mutuel-arkea-le-president-decrit-une-cyberattaque-inedite-230275) — Julien Carmona's account of the timeline, the supplier breach, the fake Fortuneo IBANs and the probable AI assistance · 13 November 2026 - [INCYBER News](https://incyber.org/article/president-credit-mutuel-detaille-piratage/) — Carmona's statements on the start date, the accounts opened in advance and the partial recovery · 14 November 2026 - [AFP (as published by France 24)](https://www.france24.com/en/live-news/20261104-french-regional-bank-says-cyberattack-caused-fraudulent-transactions) — The bank's first statement: about €100 million, contained, no client losses, Paris prosecutor's investigation · 4 November 2026 - [PC Gamer](https://www.pcgamer.com/software/ai/heist-of-a-new-kind-ai-enabled-scam-reportedly-managed-to-steal-usd110-million-from-french-bank/) — English-language coverage that framed it as an AI-enabled heist of about $110 million · November 2026 Original editorial text: CC BY 4.0. Third-party captures, source texts, names and logos retain their own rights.