Cyberattack at Maileva: Data of 22 Million People Stolen

Maileva, the professional mail-processing platform operated by Docaposte—a subsidiary of the French state-owned group La Poste—has confirmed the theft of identification data belonging to 22 million individuals. The incident, which occurred in mid-September, involved the names, first names, and postal addresses of recipients whose mail was processed on behalf of corporate clients. Reported by the specialized website Cyberattaque.org, the figure was confirmed to Agence France-Presse (AFP) by La Poste on Saturday, November 14.

The state-owned group stated that its subsidiary has notified France’s National Commission on Informatics and Liberty (CNIL) and filed a formal complaint, with a judicial investigation now in progress. "In accordance with regulations, all affected companies have been informed of the incident by Maileva," La Poste indicated in a statement provided to the agency. According to the websites FrenchBreaches and Cyberattaque.org, this represents one of the largest data breaches ever acknowledged in France.

Intrusion Detected on September 23

The events began on September 23 at 7:00 AM, when Maileva interrupted its services after detecting unauthorized access attempts to certain client accounts, which were apparently used to send mail without the owners' consent. The platform resumed operations on September 29, following a six-day shutdown, without any mention of a data breach at that time. However, on October 9, an occupational health service in Quimper acknowledged that a third party had been able to access a Maileva mail-tracking database. Notifications to clients subsequently followed throughout November.

The company now reports that "several thousand corporate clients" have been affected. Maileva claims over 70,000 users and 180 million documents processed in 2024, ranging from pay slips and general assembly notices to invoices and registered letters intended for small and medium-sized enterprises.

The figure of 22 million already accounts for duplicates. According to internal documents attributed to Docaposte, the compromised database contains approximately 39 million mail references, as a single individual may receive multiple letters from different organizations. The exposure involves names, first names, and addresses, but not the content of all mail, which varies by client. To date, there is no evidence that these files have been publicly released or sold.

Housing Providers, Laboratories, and Hospitals Affected

Several client organizations have issued information notices. Flandre Opale Habitat, a social housing company managing approximately 20,000 units in the Hauts-de-France region, indicated that the incident could involve ten years of correspondence, including names, postal and email addresses, client numbers, housing references, and invoice amounts. The landlord did not specify the exact number of tenants affected. Altéal, which manages over 14,000 units in Occitanie, also alerted its tenants on November 9; according to its notice, the data involved is more limited.

In the healthcare sector, Inovie, one of the leading French medical biology groups, confirmed that patients at several of its laboratories had their names, first names, and postal addresses exposed, though payment data and passwords were not involved. The group acknowledges that it does not yet know which specific patients were affected. In Suresnes, Hôpital Foch utilizes Kiwee, a medical debt collection firm that uses Maileva to print and mail its reminders. Mail sent between September 9 and 23 may have been accessed, exposing invoice numbers, dates of care, and amounts due. Kiwee confirmed that the incident involved mail addressed to patients on behalf of certain healthcare clients, though it did not provide a list. The IZILO transport network in Lorient is also among the victims.

Fears of Fraudulent Scenarios

The nature of the stolen data paves the way for sophisticated scam attempts. By combining a name, an address, the identity of a landlord, and an authentic invoice amount, fraudsters can create payment reminders that are difficult to distinguish from the original. Hôpital Foch described this scenario: a scammer poses as the hospital, Kiwee, the national health insurance provider, or a mutual insurance company, and then demands payment to a different account via email, SMS, phone, or paper mail. The stolen files can also be cross-referenced with other leaks. In early September, a hacker calling themselves "ChimeraZ" claimed to have leaked the names of approximately 8,000 tenants of a social housing cooperative in the Jura region, a separate case with no established link to Maileva.

Since Maileva does not individuals directly, it is up to each client organization to notify the affected parties, and no comprehensive report has confirmed how many have been reached to date. Hôpital Foch itself only learned on October 28 that its payment reminders had been accessible, more than a month after the service interruption.

A Context of Increasing Attacks

This case is part of a series of incidents targeting French companies and public organizations. The week, Crédit Mutuel Arkéa declared it had been the target of a cyberattack involving approximately 100 million euros. In early 2024, France Travail reported an intrusion to the CNIL that potentially affected 43 million people, involving social security numbers in addition to names and addresses. While the Maileva leak affects fewer people and, for most victims, less sensitive data, it remains one of the largest breaches acknowledged in France this year.

The La Poste group is no stranger to such incidents: its online services went down just before Christmas 2025, and in October, its subsidiary La Poste Mobile was targeted by pro-Russian hackers who saturated its sites without causing an intrusion or data theft. This time, however, the hackers successfully breached the system and exfiltrated information.

Implications for Clients and Investors

For Maileva’s corporate clients, the incident entails an obligation to inform affected individuals and carries significant reputational risk, particularly for social housing providers and healthcare institutions whose files reveal sensitive personal situations. Notification to the CNIL also exposes the group to regulatory oversight and potential administrative sanctions. For investors, the event highlights the operational vulnerability of mass digital service providers: the centralization of printing and mailing for thousands of organizations turns a single incident into a large-scale data breach. Authorities recommend caution regarding any payment reminders or requests for changes to banking information in the coming weeks, even when the displayed amount is accurate.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.