Cyberattack at Crédit Mutuel Arkéa: app down, bank says customers are not affected. What any bank customer in France should do in an incident like this

What happened

On Wednesday 4 November 2026, franceinfo reported a breach at Crédit Mutuel Arkéa, the group that includes the Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest federations. In a statement to France Télévisions, the bank confirmed that the attack allowed fraudulent transactions to go through. It says the situation is now under control and that customers face no financial consequences, with their interests fully protected. As a precaution, it has temporarily paused some transactions.

Since Wednesday morning, the bank's mobile app has shown an error at login. The bank says service will resume once its final checks and security measures are complete. It has not given a date.

The bank's statement gives no figure for the loss. Franceinfo, citing a source close to the case, puts it at more than €100 million. That is an estimate, not an official number. At the time of writing, the bank had shared nothing further.

What it means in practice

If you bank with Crédit Mutuel de Bretagne or Sud-Ouest, the bank says your money is not affected. For now the problems are practical: the app is unavailable and some transactions may be delayed. If rent or another important payment goes out this week, check that it actually went through once service is back. Outages like this are a reason to keep a backup way to pay, such as some cash or a card from another bank.

The real risk: the call 'from your bank'

A high-profile incident gives fraudsters a ready-made story. They pose as the bank's security team and say something like 'after the attack your account is at risk, you need to confirm a transaction now'. The Banque de France page on payment fraud sets out three simple rules:

• A genuine bank adviser will never ask you for a code, password or login, and will never ask you to make or confirm a transaction.
• Your bank does not need you to do anything to block a suspicious transaction. A request to 'confirm something to protect your account' is a red flag.
• If in doubt, hang up. Call your bank back yourself through a channel you know is safe, such as the app or a number shown in it. Do not use a number the caller gives you.

If money has already left your account

Service-public.gouv.fr sets out the steps on its card-fraud page (checked 13 February 2026). They are the same whatever your bank:

1. Block your card (opposition). Do this through your bank or by calling the interbank line 0 892 705 705, open 24/7. Calls are charged. You will get a registration number, which is a dated record of your request.
2. Report the fraud. You can report it online on the Perceval platform, which requires a FranceConnect login. Or you can file a plainte (complaint) at a police or gendarmerie station. Either way you get a receipt to send to your bank. If you don't have FranceConnect yet, the plainte is your option. According to the Banque de France, you do not need a plainte to get a refund.
3. Dispute the transactions with your bank. The rules require the bank to refund the amounts debited and any charges immediately, and at the latest by the end of the first working day after it receives your dispute. If you blocked the card late, the bank may refuse. Fraudulent payments older than 13 months cannot be refunded.
4. If the bank refuses, go to the banking mediator (médiateur bancaire) first, then to court.

A short checklist for next time

• Save your bank's number from the app or the back of your card, so you don't have to search for it online in a hurry.
• Note the blocking line: 0 892 705 705.
• Check your statements regularly, because the time limit for disputes is fixed.
• Never read out SMS codes to anyone, even a caller who knows your name and account number.

These rules apply to every bank in France. This incident is simply a good reason to go over them again.

The attack was reported by franceinfo on 4 November 2026. The advice comes from the Banque de France (page shows no update date; viewed 4 November 2026) and service-public.gouv.fr F31324 (checked 13 February 2026).