Twenty-two million individuals face compromised personal data following a massive cyberattack on Maileva, a digital document subsidiary of France’s national postal service, exposing names, postal addresses, and administrative files to malicious actors.
La cyberattaque touche le groupe La Poste et sa filiale Docaposte, à travers sa marque Maileva. As cybersecurity specialists and the Paris prosecutor’s office launch formal investigations, corporate clients across housing and healthcare sectors grapple with notification mandates under the General Data Protection Regulation (GDPR).
Maileva Data Theft Affects 22 Million People
- Scale of Exposure: The dataset impacts 22 million people, involving names, postal addresses, and administrative invoice details handled over a multi-year window.
- Operational Disruption: Maileva suspended digital infrastructure for six days starting September 23 following anomalous server activity before confirming the data theft in mid-November.
- Regulatory & Judicial Action: The Paris cybercrime section initiated formal investigations for unauthorized automated data processing, alongside mandatory notifications filed with the CNIL.
Infrastructure Vulnerability at Maileva
According to data from TF1 Info, Maileva processes approximately 180 million professional documents annually for over 70,000 corporate users, including pay slips, registered mail, and invoices.
The operational freeze began on the morning of September 23, when servers recorded irregular traffic patterns, prompting management to sever platform connectivity. Cyberattaque.org confirmed that subsequent forensic analyses verified the extraction of core identification files, turning a routine digital service provider into a vector for national data exposure. Maileva, a digital document subsidiary of the La Poste group, announced that it had been victimized by a cyberattack on Saturday, November 14, 2026.
This ranks among the most significant cyberattacks committed in France, following earlier major incidents such as the massive attack on France Travail in early 2024 that risked exposing personal data for 43 million people. “On vit un moment de multiplication des cyberattaques,” said Public Accounts Minister David Amiel on franceinfo on Sunday. Docaposte is the digital branch of the La Poste group.
The company said that the compromised accounts were blocked and services interrupted, while notifying the Commission nationale de l’informatique et des libertés (CNIL) and filing a complaint while leaving the notification of affected individuals to client organizations.
An alert was first raised by a whistle-blower before organizations began notifying clients, with the Association Santé au Travail en Cornouaille in Quimper, Finistère, reporting a security incident on October 9 involving its postal mailing provider Maileva.
| Metric Category | Reported Figure | Operational Context |
|---|---|---|
| Affected Individuals | 22,000,000 | Recipients of corporate documents sent via Maileva |
| Annual Document Volume | 180,000,000 | Invoices, pay slips, and registered notices processed in 2024 |
| Platform User Base | 70,000+ | Corporate entities and public agencies utilizing the service |
Social Landlords and Medical Networks Lose Administrative Files
Public housing authorities and medical networks bore the immediate brunt of the disclosure as notifications reached affected end-users in early November. Social landlords such as Flandre Opale Habitat and Altéal reported that administrative files, including historical correspondence spanning up to a decade, had fallen into unauthorized hands, as reported by Orange Actualités.
Altéal published its notification on November 9. On November 2, 2026, the Novabio laboratory issued a communication confirming a loss of confidentiality for personal data concerning certain patients across multiple laboratories in the Inovie group.
Hôpital Foch in Suresnes alerted patients that unauthorized actors accessed payment reminder notices dispatched between September 9 and September 23, though banking credentials and treatment specifics remained uncompromised. The hospital was informed of the situation on October 28.
Paris Prosecutor's Office Investigates Automated Data System Intrusion
The Paris prosecutor’s office confirmed that the cybercrime brigade took charge of the judicial inquiry under charges of automated data system intrusion.
“Il faut faire attention aux courriers reçus qui peuvent ressembler à des lettres légitimes, car avec l’intelligence artificielle, on peut facilement automatiser les campagnes de fraude,” said Antoine Hautin.
pointed out Antoine Hautin, speaking to franceinfo regarding the mechanics of supply chain infiltration.
