Maileva, the business mail platform run by France’s La Poste group, has confirmed that a cyberattack in September exposed the names and postal addresses of about 22 million people, roughly one in three people in France and one of the largest data breaches the country has seen.
In a statement passed to AFP by La Poste on November 14, Maileva said the attack “led to the exposure of the contact details (first name, last name, postal address) of 22 million people” who received mail from its corporate clients. The company said bank details were not involved, that it notified France’s data protection authority, the CNIL, and filed a criminal complaint, and that every affected client company has been informed, as reported by franceinfo.
Who Maileva is and why so many people are affected
Maileva is part of Docaposte, the digital arm of La Poste. Businesses, landlords, labs and hospitals use it to print and send payslips, invoices, registered letters, payment reminders and meeting notices without handling the paper themselves. It claims more than 70,000 users and says it sent 180 million documents in 2024.
That is why the number is so large. The 22 million people are not Maileva customers. They are the people those customers wrote to, and most of them have likely never heard of Maileva.
From suspicious activity to a 6-day shutdown
Maileva has not publicly explained how the attacker got in. A Docaposte information sheet sent to clients and dated October 5, which was later reported in French media, describes an outside attacker exploiting an application flaw to reach Maileva’s production systems. Based on that document and Maileva’s own client emails, the timeline runs as follows:
- September 9: First suspicious activity on Maileva’s systems
- September 16 and 17: Maileva detects the incident, including in some client environments
- September 23, 7 AM: Maileva shuts down its services as a precaution and notifies the CNIL the same day
- September 24: Clients are told investigators confirmed attempts by a cybercriminal to access accounts and send illegitimate mail, and that a complaint was filed
- September 28: A gradual restart of the platform begins
- November 14: La Poste confirms the 22 million figure publicly
According to the October 5 sheet, the database the attacker reached was a mail tracking system holding 39 million letter references. After removing duplicate recipients, Maileva put the number of distinct people at about 22 million. Depending on the client contract, that history can go back up to 10 years.
Some letters were readable
Maileva’s statement lists only names and postal addresses, but some of its clients say the contents of their letters were exposed too.
Hôpital Foch in Suresnes, west of Paris, told patients in a notice on its website that payment reminder letters “may have been read by a hacker.” The hospital sends those reminders through the billing company Kiwee, which has them printed and mailed by Maileva. Foch says it learned on October 28 that reminders sent between September 9 and September 23 were affected, exposing patients’ names, addresses, invoice numbers, dates of care and amounts owed. The letters do not mention the type of care or bank details, but Foch notes they reveal that the person was treated at the hospital, which it calls sensitive information. Foch has also reported the incident to the CNIL.
Other organizations have issued their own notices. Social housing provider Flandre Opale Habitat said administrative or financial information, such as invoice amounts, may have been exposed in letters sent over the past 10 years, according to franceinfo. Several laboratories in the Inovie medical testing group told patients their names and postal addresses lost confidentiality, and said no payment data or passwords were involved.
Paris prosecutors open an investigation
The Paris prosecutor’s office confirmed on November 15 that its cybercrime section opened an investigation for unauthorized access to an automated data processing system, and that the case has been assigned to the Brigade de lutte contre la cybercriminalité (BL2C), according to 20 Minutes.
No group has publicly claimed the attack, and Maileva has not said whether a ransom was demanded. BreachNews has not seen the stolen data.
Another big French leak through a service provider
The case follows a familiar pattern: attackers go after a provider that quietly handles data for thousands of organizations, and the people affected learn about it secondhand, if at all. Under the GDPR, it is largely up to Maileva’s client companies to tell their own customers, tenants and patients. That means many of the 22 million people may never receive a direct notice.
It is the latest in a run of large French data leaks, following the France Titres breach earlier this year. It also mirrors the recent Arara Message breach, where a messaging provider’s compromise put tens of millions of email addresses at risk.
What people in France should watch for
A name and home address, sometimes linked to a hospital, lab or landlord, is exactly what scammers need to send convincing fake bills or payment reminders by mail, email, text or phone. Foch warns patients to be suspicious of any request for money that seems to come from the hospital, Kiwee, the national health insurance system or a mutual insurer, and says it will never ask for passwords, codes or bank details by email, text or phone.
If a letter or message asks you to pay or update bank details, contact the organization through a phone number or website you already trust, not the details in the message. Our guide on how to tell if a data breach notification letter is real covers the warning signs.
