Attackers broke into Maileva, the online mailing service run by La Poste's digital subsidiary Docaposte, and stole the first names, last names and postal addresses of about 22 million people in France. La Poste confirmed the figure to AFP on 14 November 2026, almost two months after Maileva shut down its services. The specialist sites FrenchBreaches and Cyberattaque.org reported the breach first. The people affected are not Maileva customers. They are people who received letters sent through the platform by "several thousand" client organisations, including social housing landlords, medical laboratories and a hospital's billing contractor. Maileva says it has notified France's data protection authority, the CNIL, and filed a criminal complaint. A judicial investigation is under way. La Poste says bank details were not compromised. However, at least one affected client has warned its tenants that the exposure may reach beyond names and addresses.
What Happened
Maileva lets businesses and public bodies send payslips, registered letters, invoices, payment reminders and shareholder meeting notices without printing anything themselves. It claims more than 70,000 users and says it sent 180 million documents in 2024.
The public account has changed over time. On 23 September, at 7 a.m., Maileva suspended all of its services. According to Cyberiack and Cyberattaque.org, the company first described the problem as unauthorised attempts to access client accounts in order to send fake letters. FrenchBreaches reports that services began coming back from 28 September.
On 9 October, FrenchBreaches published details from an internal Docaposte document dated 5 October, which gave a different picture. According to that document, as reported by FrenchBreaches and Cyberiack:
- Suspicious activity started on 9 September.
- The intrusion was detected on 16 September, a week before the shutdown.
- An outside attacker reached Maileva's production systems by exploiting a flaw in one of its applications.
- The attacker reached the mail-tracking database, which holds 39 million mail references.
Maileva confirmed the 22 million figure in a written reply that Cyberattaque.org published on 13 November. La Poste then confirmed it to AFP on 14 November, and Le Parisien, franceinfo, RTS and Security Affairs all reported it. La Poste says Maileva has informed every affected client company "in accordance with the regulations". It is now up to those companies to notify the people whose letters they sent.
Cyberattaque.org and Security Affairs name these affected organisations:
- Social housing: Flandre Opale Habitat and Altéal
- Medical laboratories in the Inovie group: AXBIO, BioMedilab and Biofusion
- Hospitals: patients of Foch Hospital in Suresnes, affected through its billing and debt-collection contractor Kiwee.care, which prints and posts letters through Maileva
Flandre Opale Habitat told its tenants on 3 November that it had notified the CNIL itself.
What Was Taken
Volume. All reporting agrees on about 22 million people. That figure comes from removing duplicates from the 39 million mail references in the tracking database, according to the Docaposte document reported by FrenchBreaches and Cyberiack. Cyberiack adds that, depending on each client's contract, the records may go back as far as ten years. Flandre Opale Habitat also refers to letters sent "over the last 10 years".
Data types: the accounts do not fully agree.
- Maileva and La Poste say the stolen data is limited to first name, last name and postal address, and that bank details are not affected.
- FrenchBreaches reports that bank information belonging to client companies was exposed in a separate part of the incident. This does not necessarily contradict La Poste's statement, which concerned the individuals who received letters. La Poste has not commented publicly on business banking data.
- Flandre Opale Habitat warned tenants that the data at risk could include email addresses, customer numbers, housing details, invoice amounts and "more generally, certain personal data contained in the letters". The landlord stressed that this does not mean the data was actually viewed or used.
- Security Affairs, citing reporting on Kiwee.care, says the attacker reportedly read the contents of some payment reminders. Those letters carried invoice numbers, treatment dates and amounts owed. If confirmed, that would expose health-related billing data, and other healthcare clients of Kiwee could also be affected. Maileva has not publicly confirmed that letter contents were accessed.
The question that matters most is whether the attacker took only the tracking metadata or also the letters themselves. Maileva's public statements describe metadata only. The warnings from its own clients leave open the possibility that letter contents were exposed too.
Why It Matters
Scale and invisibility. At roughly a third of France's population, this is one of the largest confirmed personal data breaches in France in 2026. Most of the victims have never heard of Maileva and had no direct relationship with it.
Context makes the data useful to fraudsters. A name and address on its own is low-sensitivity data. Here, each record is tied to who sent the letter: a landlord, a laboratory, a hospital or a debt collector. That lets criminals send convincing fake letters, texts and calls, such as "your lab invoice is overdue" or "your rent account needs updating", aimed at people who really did receive that kind of letter. Le Parisien and Flandre Opale Habitat both warn about phishing and fraud attempts. A postal platform is also a natural channel for fake paper mail, and fake mail sent through hijacked accounts was what Maileva first said the attacker was attempting.
Supply-chain exposure. Thousands of organisations have inherited a breach notification duty from a single supplier. Foch Hospital's patients were exposed two steps down the chain, through a contractor's contractor.
Disclosure gaps. About two weeks passed between detection on 16 September and the shutdown on 23 September, according to the internal document. The first public explanation described account-access attempts rather than a breach of the production system. The full scope only became public after independent sites published leaked documents. This adds to the run of large French breaches in recent years, including France Travail's exposure of 43 million records in early 2024, which RTS notes.
The Attack Technique
Only limited technical detail is public. According to the Docaposte document as quoted by FrenchBreaches and Le Parisien, "an external malicious actor" gained "unauthorised access to Maileva's production information system by exploiting an application flaw." The vulnerable application, the type of vulnerability and any CVE have not been disclosed.
The reported timeline points to about a week of undetected access (9 to 16 September). Maileva's first statement suggests the attacker may also have tried to abuse client accounts to send letters. No group has claimed the attack, no ransom demand has been reported, and none of the reporting describes the data being offered for sale. Maileva has not said whether the data has been published.
What Organizations Should Do
- Find out whether you used Maileva, directly or through a supplier. Check printing, billing and debt-collection contractors such as Kiwee.care. Ask each one in writing which of your mailings and date ranges were in the affected database, and whether letter contents or only metadata were exposed.
- Assess your own notification duties. If you are the data controller for the letters, review GDPR Articles 33 and 34. Several clients, including Flandre Opale Habitat, have already notified the CNIL themselves. Plan notifications around the content of the letters, not just names and addresses, especially for health or financial correspondence.
- Warn customers about fraud that uses your name. Tell recipients how you really contact them, which channels you never use to ask for bank details or payment, and how to check a letter or call. Watch for lookalike domains and spoofed sender identities.
- Lock down accounts on outsourced mailing platforms. Turn on MFA, rotate credentials and API keys, review sending logs since early September for letters you did not send, and set up approval steps for bulk or unusual sends.
- Limit what mailing suppliers keep. Ten years of history on a third-party platform is a liability. Set contractual retention limits, require deletion after delivery where possible, and avoid sending sensitive details such as treatment dates when they are not needed.
- Write supplier breach terms into contracts. Require notification within days of detection, not of public disclosure, with a defined scope of what was accessed. The gap here between the internal 5 October assessment and public confirmation on 13 to 14 November is the kind of delay those clauses should prevent.
Sources: Data Breach at La Poste Subsidiary Maileva Affects 22 Million Peopl... | Maileva (La Poste) confirme le vol des adresses de 22 millions de d... | Cyberattaque : les données de 22 millions de personnes exposées che... | Cyberattaque : 22 millions de données volées chez une filiale de La... | Des données de millions de personnes volées et un risque de fraudes... | Flandre Opale Habitat Information : incident de sécurité chez notr... | Victime d'une cyberattaque, Maileva, une filiale du groupe La Poste... | Docaposte confirme le vol des adresses de 22 millions de Français a...