PRESS RELEASE

Additional Information Following the Cyberattack on Crédit Mutuel Arkéa

Brest, November 4, 2026, at 5:30 p.m. – Following the latest press release published at 1:00 p.m., please find below further details addressing the main questions you have sent us.

1/ What exactly happened?

The attackers used Crédit Mutuel Arkéa's own account to carry out transactions to other banks, which may then have enabled them to convert the money into cryptocurrency via specialised platforms. They therefore did not go through the accounts of customers of its federations or subsidiaries. We have stated that this incident has no financial consequences for our customers. As soon as this attack was identified, our teams immediately activated the necessary security measures to contain the incident and prevent any further fraudulent movements against Crédit Mutuel Arkéa.

2/ Did the attackers get in through Fortuneo, as has been reported in the press?

No. Despite what has been reported, there was no “entry” through Fortuneo. The attackers went through the platform of one of our service providers and thereby reached Crédit Mutuel Arkéa directly.

3/ What are the consequences for customers of the bank or Fortuneo?

None. We wish to reassure all of our customers: this incident has had no impact on their assets. It only caused a delay in the execution of certain transfers.

This incident is now under control. Almost all operations resumed during the morning, after the Group and its subsidiaries completed verifications and put enhanced security measures in place.

4/ Was human error at Arkéa the cause of the attack?

No. This was a sophisticated attack from outside, which has now been contained.

Our security systems made it possible to identify the suspicious activity very quickly and to take the necessary measures to contain the attack.

Our teams are working with the competent judicial and law-enforcement authorities to determine precisely the origin of the attack and its modus operandi.

5/ Did you take immediate action to counter this attack?

As soon as the attack was detected, the necessary measures were taken under existing crisis procedures. The incident is now under control.

In accordance with standard procedures, the Group contacted the relevant authorities and supervisory bodies to inform them of the situation.

The teams were mobilised accordingly and, as a precautionary measure, the decision was taken to temporarily suspend certain transactions in order to secure operations and prevent any fraudulent movements.

6/ Can you confirm that 118 million euros ($133 million) were stolen?

We do not confirm this information and can only validate the order of magnitude.

Our teams are continuing their work to assess the financial consequences of this attack precisely: part of the funds concerned has been blocked, and other actions are under way to recover them. While it is therefore still too early to communicate a final amount, we can already state that the amounts involved are in no way of a nature to undermine the financial strength and soundness of Crédit Mutuel Arkéa.

7/ In your press release, you mention phishing. Does that mean customer data has been compromised?

In the context of attacks of this nature, it is common to see an upsurge in phishing attempts that may seek to extort confidential data. We therefore consider it essential to raise our customers' awareness as a preventive measure by urging them to remain extremely vigilant.

Link to the previous press release published on November 4 at 1:00 p.m.

About Crédit Mutuel Arkéa

A cooperative banking and financial services group, Crédit Mutuel Arkéa comprises the federations Crédit Mutuel de Bretagne and Crédit Mutuel du Sud-Ouest, their affiliated local banks, as well as around forty specialised subsidiaries (Fortuneo, Monext, Arkéa Banque Entreprises et Institutionnels, Arkéa Asset Management, Arkéa Capital, Suravenir, Arkéa Assurances, etc.). It has 12,073 employees, 2,600 elected directors, more than 5.8 million members and customers, and reports total assets of €211.5 billion. Leveraging the diversity of its expertise and the uniqueness of its business model, Crédit Mutuel Arkéa is committed to supporting environmental and societal transitions, in line with its status as a mission-led company. A leading financial partner in Brittany and in the South-West of France, Crédit Mutuel Arkéa relies on its “Faire 2030” strategic plan to accelerate its development and transformation, serving a bold strategy driven by a collective of engaged employees and members united around a common promise: “With you, with all our strength.”

Press contacts:
Matthieu Senecot - matthieu.senecot@vae-solis.com

Solen Deltour - solen.deltour@arkea.com

Suivez-l'actualité du Crédit Mutuel Arkéa sur les réseaux sociaux cm-arkea.com