Crédit Mutuel Arkéa and a supplier's platform: lessons for cyber underwriters

Topic of the week, 31 October to 7 November 2026 · by cybercoverinsurance

On 4 November 2026 Crédit Mutuel Arkéa, a cooperative banking group that includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, disclosed a cyber attack that enabled fraudulent transactions. The attackers got in through a supplier's platform and used the bank's own account to send transfers to other institutions. The loss exceeds 100 million euros. Customer accounts were not touched.

The case is neither ransomware nor a data breach. It is a theft of money from a bank's own account, routed through a supplier and converted into cryptocurrency within hours. For cyber underwriters it raises three questions: which policy responds to a direct loss of funds, what happens if the same supplier serves other banks, and which controls stop a transfer before it becomes irreversible.

What is known

The attack. The bank explained that the attackers "went through the platform of one of our suppliers", which it did not name, and used the bank's account to transfer funds to other banks, without going through the customer accounts of its federations and subsidiaries. It called the attack sophisticated and external and ruled out internal human error. No one has claimed the attack (DH).

The amount. The bank's provisional estimate is about 100 million euros. Le Télégramme reported 118 million euros, converting 133 million dollars; the bank did not confirm the figure but said the order of magnitude was right (Boursorama). On 6 November Daniel Baal, president of the Confédération nationale du Crédit Mutuel, confirmed that the total exceeds 100 million and that part of the funds had been recovered, without saying how much (Quartz).

The response. Some transactions were suspended as a precaution and almost all resumed on the morning of 4 November. The bank filed a complaint with the cybercrime section of the Paris prosecutor's office, which opened an investigation into fraudulent access to an IT system by an organised group, assigned to the Office anticybercriminalité. The bank says the amount does not threaten its soundness; it reported 230 million euros of net profit in the first half of the year (Boursorama).

The path of the funds. According to on-chain analysis by ZachXBT and Bitquery, reported by Ostraca, stablecoin withdrawals from exchanges began on 1 November, a Sunday, and about 108.8 million dollars in USDC left Kraken, Crypto.com and OKX within 21 hours. Part was then converted into ether (Ostraca). These are third-party reconstructions, not confirmed by the bank. According to Baal, the exchanges themselves, together with the bank's security systems, raised the alarm (Quartz).

What is not known. The supplier's name, the type of platform, how it was compromised, how long the operation lasted and how much was recovered have not been made public.

A loss of funds, not a data incident

The loss is the money itself. In most cyber claims the cost comes from downtime, restoration, notification and liability. Here the main loss is the money that left the bank's account. For a financial institution, this loss usually falls under financial institution crime cover, with its computer fraud insuring agreement, rather than the cyber policy.

The boundary between policies. Many cyber policies exclude or limit loss of the insured's own funds, or cover it only with a sublimit for funds transfer fraud. Bank crime covers respond to computer fraud but often not to investigation, restoration and incident response costs. An event like Arkéa can touch both: the loss of funds on one side, forensic and management costs on the other. If the two policies sit with different insurers, each may point to the other.

The trigger matters. Computer fraud agreements usually respond to fraudulent entry or change of data in the insured's systems. If entry comes through a supplier's platform, the wording must make clear whether the supplier's systems count as the insured's systems. It is the first clause to reread.

The supplier as the way in

One platform, how many banks? Antoine Hautin, secretary general of consultancy Almond, asked the central question: if the supplier serves several banks and the method can be repeated, the risk becomes systemic (DH). For underwriters it is an aggregation scenario: one compromised banking services supplier, several institutions hit in the same weekend.

The supplier is not named. Without the name, an insurer cannot know which other insureds use the same platform. It is the same difficulty seen with a supplier's script in the Polymarket case in October: the dependency exists, but the questionnaire does not record it.

DORA makes the topic mandatory. For European banks the DORA regulation requires a register of ICT service providers and the reporting of major incidents to supervisors. The bank said it had informed the competent bodies (Ostraca). For an insurer, the DORA register is the most complete source for understanding which suppliers an institution depends on.

The speed of conversion

Hours, not days. According to on-chain reconstructions, more than 100 million dollars left the exchanges in less than a day (Ostraca). Once converted and moved, recovery is hard. Lawyers quoted by DH propose a mandatory delay on fiat-to-crypto conversions to allow fraud checks.

The chosen day. Withdrawals reportedly began on Sunday 1 November, a public holiday in France (Ostraca). An attack at a weekend or on a holiday exploits lower staffing. The questionnaire should ask not only whether controls exist, but whether they work at three in the morning on a Sunday.

Partial freezing worked. Kraken reportedly restricted some accounts and Tether reportedly froze about 1.14 million USDT (Ostraca). The bank recovered part of the funds (Quartz). For the claim, every euro recovered reduces the net loss, and the speed of reporting to exchanges is a control that weighs on the final amount.

Controls that stop the transfer

Limits on the bank's own account. Outbound payment controls are often designed for customer accounts. Here the bank's own account was used. Thresholds, dual authorisation and checks on new beneficiaries must also apply to treasury movements and to flows generated by third-party platforms.

Monitoring of unusual flows. A series of transfers to new destinations, on a public holiday, to institutions that in turn feed cryptocurrency exchanges, is a recognisable pattern. The question is whether monitoring catches it automatically or only when someone is looking.

Supplier access. If the supplier's platform can create payment orders on the bank's behalf, that access should be treated as privileged access: minimal permissions, strong authentication, logging and periodic review.

What to bring to renewals

Impact for insurersHigh

A theft of more than 100 million euros from a bank's own account, routed through the platform of an unnamed supplier, shows a risk of direct loss of funds and possible aggregation across several institutions.

On the portfolio side, the Arkéa case suggests asking insured financial institutions which payment and treasury platforms they share, and including in aggregation tests a scenario in which a common supplier is used for fraudulent transfers from several banks in the same weekend, with direct loss of funds and response costs for each.

Sources

• DH – the bank's statement, the supplier and the open questions
• Boursorama – amount, investigation and the bank's response
• Quartz – recovered funds and statements by the president of Crédit Mutuel
• Ostraca – cryptocurrency flows, freezes and authorities involved