Maileva Cyberattack Exposes Names and Addresses of 22 Million People in France

A cyberattack on Maileva, the business-mail platform owned by France's La Poste group, stole the names and postal addresses of 22 million people, La Poste confirmed to the AFP news agency on Saturday, November 14. Specialist websites that first reported the incident describe it as one of the largest data leaks ever acknowledged in France.

The victims were not Maileva account holders. They were the recipients of letters sent through the platform on behalf of its client companies — payslips, registered letters, invoices and meeting notices addressed to employees, customers, patients and tenants across France. Many of them may never have heard of Maileva at all.

What was stolen — and what was not

According to La Poste, the attack "led to the exposure of the contact details (first name, surname, postal address) of 22 million people, recipients of mail from Maileva's client companies". The figure counts each person once: the compromised mail-tracking database held around 39 million mail references, and once duplicates were removed, they corresponded to about 22 million distinct individuals.

Bank details were not affected, Maileva said, and there is no evidence at this stage that the stolen data has been released or put up for sale. The theft of the full contents of the letters themselves has not been confirmed either, though at least one client has warned its patients about potentially exposed correspondence. Hôpital Foch in Suresnes told patients that payment reminders sent between September 9 and September 23 may have been exposed, including invoice numbers, treatment details and amounts owed.

A two-month silence before the confirmation

The attack itself dates back to mid-September. The first suspicious activity on Maileva's systems was detected around September 9, and on September 23 at 7 a.m. the platform suspended its services after spotting unauthorised attempts to access client accounts, apparently to send mail without the owners' consent. Operations resumed on September 29, after a six-day shutdown, with no mention of a data breach at the time.

The scale only became public in stages. An internal Docaposte document dated October 5, revealed by the specialist site FrenchBreaches on October 9, already put the figure at 22 million people. On November 13, Maileva confirmed the number in a written response to the site Cyberattaque.org, and the following day La Poste confirmed it to AFP, confirming the reporting of both specialist sites.

Maileva has notified the CNIL, France's data protection authority, and filed a criminal complaint. A judicial investigation is under way, and La Poste said all the client companies concerned have been informed of the incident.

Who is behind the attack?

Maileva has said nothing about the identity of the perpetrators. Security Affairs reported that the pro-Russian hacking group Noname057 has claimed responsibility for the attack, but that claim has not been confirmed by La Poste or the authorities. According to Cyberattaque.org, an attacker exploited a vulnerability in a Maileva application to reach its production system.

Part of a wider wave

The Maileva breach is the latest in a series of major cyberattacks to hit French organisations. In early 2024, the state employment agency France Travail was targeted in an attack that put the personal data of 43 million people at risk of disclosure. Last year, La Poste itself was hit by a cyberattack claimed by pro-Russian hackers a few days before Christmas. And only last week, the bank Crédit Mutuel Arkéa said it had been the target of a cyberattack involving a sum of around €100 million.

Maileva is a subsidiary of Docaposte, itself part of the La Poste group. The platform, which specialises in sending business mail for small and medium-sized companies, says it has more than 70,000 users and sent 180 million documents in 2024. That reach is precisely what makes the breach so large: a single platform handling other companies' mail can expose the details of millions of people who never signed up for the service themselves.

For the 22 million people affected, the immediate risk is limited — names and postal addresses alone cannot drain a bank account — but the data is exactly the kind used for identity fraud and targeted phishing, where a letter that looks like it comes from a known employer, hospital or landlord is far more convincing. Anyone receiving unexpected mail or messages referencing their address should treat it with caution.

Related reading: Uber drivers' licence data stolen in Fireworks AI breach

Sources

• Le Temps / AFP — "Subsidiary of France's La Poste suffered major cyberattack in September, more than 20 million people affected", November 14, 2026
• Cyberiaque — "Maileva (La Poste) confirms theft of the addresses of 22 million mail recipients", November 13, 2026
• Security Affairs — "Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France", November 15, 2026
• Europesays / BigGo Finance — "Cyberattack at Maileva: Data of 22 Million People Stolen", November 14, 2026
• Heyday News — "Maileva breach: 22 million people's data stolen, letters at risk", November 15, 2026