Skip to content
Mass Data Breach at Maileva Exposes 22 Million Customers' Personal Information

Mass Data Breach at Maileva Exposes 22 Million Customers' Personal Information

First seen 15 Nov 2026, 00:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 15, 2026 at 00:13 UTC
  • •22 million individuals' personal data stolen in a cyberattack on Maileva.
  • •The breach involved names, addresses, and other identification data but not mail content.
  • •A judicial investigation is underway, and affected organizations have been notified.

Maileva, a subsidiary of La Poste in France, confirmed a cyberattack in mid-September that resulted in the theft of personal data from 22 million individuals. The breach involved names, first names, and postal addresses of recipients whose mail was processed for corporate clients. La Poste reported the incident to the National Commission on Informatics and Liberty (CNIL) and has initiated a judicial investigation. The attack was detected on September 23, leading to a temporary service shutdown. Although the breach was not disclosed until November, it is considered one of the largest data breaches in France's history. Affected organizations include housing providers and health services, with notifications sent to impacted clients. As of now, there is no evidence that the stolen data has been publicly released or sold.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-09-23
Unauthorized access detected
Maileva interrupted services after detecting unauthorized access attempts to client accounts.
Finance.Biggo
2026-09-29
Services resumed
Maileva resumed operations after a six-day shutdown without disclosing the data breach.
Finance.Biggo
2026-11-14
Breach confirmed publicly
La Poste confirmed the data breach affecting 22 million individuals to the AFP news agency.
Repubblica.It

More articles in this cluster (2)

Following this threat?

Track CNIL in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What personal data was stolen?
The breach involved names, first names, and postal addresses of 22 million individuals.
Is there evidence of data being sold?
Currently, there is no evidence that the stolen data has been publicly released or sold.
What actions are being taken?
La Poste has notified the CNIL and filed a formal complaint, with a judicial investigation underway.