La Poste says Maileva cyber attack exposed names and addresses of 22 million

La Poste told AFP that a cyber attack hit its Maileva subsidiary in mid-September 2026, exposing the names and postal addresses of 22 million people in France.

The stolen information covers first and last names and postal addresses of people who received correspondence handled by Maileva for companies. The affected people are recipients of mail sent on behalf of Maileva’s corporate clients, and they are not direct Maileva customers. Most had no prior knowledge of Maileva and no direct relationship with the company. Maileva said bank details were not compromised in the breach.

Maileva processes business correspondence such as payslips, registered letters and invoices for corporate clients. The company is part of Docaposte, a subsidiary of the La Poste group, and it sent 180 million documents in 2024. Sources disagree on Maileva’s user count: Security Affairs and La Repubblica put it at more than 70,000 users, while Albeu.com gives a figure of more than 70 million users.

Security Affairs names the social housing providers Flandre Opale Habitat and Altéal among affected organizations, along with Inovie group laboratories AXBIO, BioMedilab and Biofusion. The breach affected patients of Foch Hospital in Suresnes through a subcontractor, Kiwee.care, which handles friendly debt collection and medical billing and prints and mails through Maileva. The breach may also have affected other healthcare clients of Kiwee.care. A hacker reportedly read Kiwee.care payment reminders handled by Maileva that showed invoice numbers, treatment dates and amounts owed.

Maileva notified the CNIL, France’s data protection authority, and filed a criminal complaint, and a judicial investigation into the breach is underway. La Poste confirmed the investigation. The company said it informed every affected organization as regulations require, though whether affected companies will notify their own patients and tenants remains unresolved, a question Security Affairs describes as separate. Specialized sites FrenchBreaches and Cyberattaque.org flagged the Maileva breach first.

The affected individuals received documents through Maileva’s platform without any prior relationship to the company. This means the breach reached patients, tenants and other individuals who never signed up with Maileva itself.

La Poste suffered a previous major cyber incident in December 2025 that disabled its information systems and cut off digital banking and online services for millions of customers. The outage made La Poste’s website, mobile app, digital identity service, Digiposte platform, laposte.fr, La Banque Postale and its app temporarily inaccessible. La Poste disclosed the disruption on social media. Pro-Russian hackers claimed responsibility for the December 2025 attack, with Security Affairs identifying the group as Noname057; La Repubblica says pro-Russian hackers claimed responsibility without naming the group.

France has experienced a series of major data breaches recently. More than 33 million people had data exposed in 2024 breaches at Almerys and Viamedis, part of a wave of recent major cyber attacks in France. A France Travail breach affected 36.8 million people. In February, the French Economy Ministry said a hacker used stolen government official credentials to access data from 1.2 million bank accounts.

Tchap, the French government’s encrypted messaging platform for civil servants made mandatory the previous year, suffered a breach in June. Nearly 700,000 people had data linked to summer attacks targeting French tax authorities. Crédit Mutuel Arkéa reported a cyber attack costing around €100 million.

CNIL recorded over 5,600 data breaches in 2024, a rise of 20 percent from the prior year. Security Affairs cites France’s economic importance and political position on the war in Ukraine as reasons the country is an attractive cyber target. Maileva’s notification of the CNIL and affected companies reflects France’s breach-notification obligations under data-protection rules. Security Affairs says affected individuals should watch for misuse of the exposed data, including phishing and mail-fraud schemes tied to payment reminders and invoices.