On November 4, 2026, Crédit Mutuel Arkéa issued a statement confirming that the attacker gained access through the platform of an unnamed third-party service provider, then used the bank's own accounts to transfer funds to other financial institutions. The funds may have subsequently been converted into cryptocurrency through specialized platforms. The bank denied that the breach originated from its online banking subsidiary, Fortuneo, and stated that customer assets were not affected. Regarding the approximately $133 million in losses previously reported by ZachXBT, the bank did not confirm the exact figure but acknowledged the scale of the incident. Some funds have been frozen, while the final losses remain under assessment.