A major French data breach confirmed
The working headline is stark and, after the latest reporting, accurate: La Poste unit Maileva hacked, data of 22 million people stolen. Over the weekend of 14 November 2026, La Poste confirmed to AFP that Maileva, a subsidiary brand in the Docaposte ecosystem, suffered a cyberattack in mid-September that led to the theft of contact details for 22 million people . The data confirmed as exposed consists of first names, surnames and postal addresses belonging to recipients of mailings handled for Maileva’s corporate and institutional clients .
The figure makes the incident one of the largest recent personal-data exposures reported in France, not because it involves the most intimate categories of information for every victim, but because of its scale and the nature of Maileva’s role in administrative correspondence . Maileva is used by organizations to outsource document and postal workflows, which means a compromise at this kind of intermediary can ripple outward across sectors without those downstream organizations necessarily having been directly hacked .
La Poste’s confirmation followed specialist reporting by Cyberattaque.org, which said it obtained written confirmation from Maileva after several weeks of investigation . According to that report, Maileva acknowledged that “22 million people” were affected by the theft of identification data and that several thousand customer organizations were concerned . AFP-based coverage published later on 14 November reported the same figure and said the exposed data were first name, last name and postal address, while stating that bank details were not affected according to the information transmitted by La Poste .
What Maileva does, and why the breach spreads so widely
Maileva is not a consumer social network or an ordinary email provider. It is a professional document and mail platform associated with Docaposte and the La Poste group, used to send and manage business, administrative and postal communications . That positioning matters because the people whose data was stolen may never have knowingly opened a Maileva account; many are likely recipients of letters sent by companies, public-service operators, landlords, transport bodies, health-sector entities or other institutions using Maileva as a provider .
This is why the breach has a complicated public-facing perimeter. Cyberattaque.org reported that several thousand Maileva client companies are affected and cited sectors including social housing, health and public services . Le Parisien similarly reported that clients of laboratories, social landlords and even patients linked to a hospital in the Paris region may have had data compromised after the Maileva attack . The breach is therefore best understood as a supply-chain or service-provider incident: the initial attack targeted a centralized platform, but the consequences are distributed through many organizations that used it.
Frandroid reported that Maileva had cut its services on 23 September, and that the earliest suspicious activity identified in a Docaposte information sheet dated 5 October reportedly went back to 9 September . The same report said services were suspended after unauthorized access attempts affecting customer accounts, initially associated with the risk of sending fraudulent letters . The public picture has since shifted from “attempted unauthorized access” to a confirmed theft of data affecting 22 million people .
What data was stolen, and what was not confirmed
The core data set confirmed in current reports is limited but far from harmless: first name, surname and postal address . Cyberattaque.org says Maileva described the stolen information as “données d’identification,” namely first name, last name and postal address . Boursorama’s AFP-based report also states that other personal information such as bank details was not affected, according to Maileva management’s statement transmitted by La Poste .
That distinction is important but should not be misunderstood. A leak of names and postal addresses may not have the immediate financial impact of exposed card numbers or passwords, but it can still support highly credible scams. Le Parisien reported that the incident raises fears of phishing and fraud for many users . Frandroid also noted that, depending on the client organization, some notifications point to additional contextual information such as hospital invoice amounts or dates of care, which would increase the sensitivity of the breach for those particular recipients .
The public record therefore has two layers. At the Maileva-wide level, the confirmed stolen data are names and postal addresses . At the client-by-client level, the precise information contained in a given mailing file may vary, and some customers or recipients may receive more specific breach notices from the organization that originally used Maileva for the mailing . This is why a person’s risk may depend not only on being one of the 22 million records, but also on which organization sent the underlying correspondence.
Notification, complaint and investigation
La Poste said Maileva had notified France’s data-protection authority, the CNIL, and filed a complaint, with a judicial investigation underway . That point is central because it shows the incident has moved beyond internal remediation and into formal regulatory and law-enforcement channels . In France and under European data-protection rules, the controller or processor relationships in an outsourced correspondence chain can shape who must notify whom, and how quickly affected individuals are informed.
Cyberattaque.org reported that Maileva said all affected organizations had been informed in line with regulations, while the task of informing individuals falls to Maileva’s client organizations . That helps explain why public notifications may arrive gradually and unevenly: Maileva’s direct customers must assess the nature of the compromised files, the risk to individuals and their own communication obligations . A laboratory, a landlord, a transport operator and a public body may not all hold the same type of data, even if they used the same mailing platform.
Le Parisien’s follow-up coverage framed the practical result as a slow expansion of known victims, with different sectors discovering or disclosing their exposure as the Maileva perimeter becomes clearer . This pattern is typical of large third-party incidents: the first confirmed number gives the scale, but the operational detail emerges through individual customer notifications.
Why postal-address data can be weaponized
The absence of confirmed bank-data theft at Maileva level does not make the incident low-risk. Names and addresses can be used to personalize scams sent by email, SMS, telephone or physical mail. In this case, the postal nature of the data is especially relevant because fraudsters could plausibly imitate administrative letters, medical billing notices, social-housing correspondence, rent reminders, transport fines or other official-looking documents.
The risk is not theoretical. Le Parisien explicitly reported fears of phishing and fraud after the confirmation that millions of people’s data had been stolen . Frandroid reported that some affected clients involved hospital invoices and care dates, which could help attackers craft convincing healthcare-related approaches where such additional information exists . Even when the stolen data are limited to name and address, attackers can combine them with information from earlier breaches, public directories or social engineering.
For individuals, the most realistic danger is not that someone immediately opens a bank account using only a name and address. It is that criminals gain one more credible anchor for a message that appears routine: a fake reimbursement notice, a supposed unpaid bill, a false update request, or a QR code leading to a malicious payment page. The breach therefore increases the value of skepticism toward unexpected correspondence, especially messages claiming urgency, penalties, refunds or identity verification.
The unresolved questions
Several key questions remain unanswered in the public reporting available as of 15 November 2026. First, there is no full public technical account of how the attackers gained access, how long they remained present, or whether the compromise involved customer credentials, internal systems, file repositories or another pathway. Frandroid reported that initial suspicious activity dated back to 9 September and that Maileva cut services on 23 September, but a complete technical chronology has not been published in the current public reports .
Second, the final list of affected organizations has not been publicly consolidated. Cyberattaque.org reported that several thousand customer organizations are concerned, including in social housing, health and public services . But individuals may only learn whether their data was included when the original organization that sent them mail completes its own analysis and notification process .
Third, the exact variance in data fields across clients remains unclear. Maileva-wide confirmation points to first name, last name and postal address . However, reporting about client-specific notices suggests some mailings may have embedded additional contextual information such as amounts, dates or customer references . That makes the breach both broad and uneven: millions may share the same basic exposure, while smaller groups may face more specific risks.
What affected people should do now
Anyone in France who receives a notification linked to Maileva should read it carefully and identify which organization sent it. Because Maileva’s clients are responsible for informing affected individuals, the most relevant details may come not from Maileva directly but from a laboratory, landlord, hospital, transport operator, employer, public body or service provider that used the platform .
People should be cautious with unexpected letters, emails, SMS messages or calls that reference an address, an administrative file, a healthcare matter, a bill, a rent payment or a refund. The stolen data can make fraudulent messages look more legitimate, and Le Parisien reported that the breach has raised concerns about phishing and fraud . Recipients should avoid scanning QR codes or clicking links in unsolicited messages demanding payment or urgent verification, and should instead contact the relevant organization through a known official channel.
For organizations that used Maileva, the immediate task is different. They need to determine which files were handled through the compromised service, what fields were included, whether the exposed information creates a high risk for individuals, and what notification language is appropriate. Cyberattaque.org reported that Maileva says it informed affected organizations, but that individual notification falls to those customer organizations .
A trust problem for digital administrative infrastructure
The Maileva incident is not just another corporate breach. It strikes at the infrastructure used to move administrative information between organizations and citizens. Maileva sits at the junction of digital workflow and physical mail, which is exactly where many people expect reliability, legal formality and institutional trust. A breach at that junction can undermine confidence even if the confirmed stolen data fields are narrower than in some other cyberattacks.
The scale is the central fact: 22 million people, several thousand customer organizations, and a provider embedded in everyday administrative communications . The next phase will be measured less by the headline number than by the clarity of notifications, the findings of investigators, and the ability of La Poste, Docaposte and Maileva customers to explain exactly what happened to the people whose addresses are now in criminal hands.