Maileva, the business-mail platform owned by French postal group La Poste, has confirmed that a cyberattack in mid-September exposed the names and postal addresses of 22 million people. La Poste disclosed the scale of the theft to Agence France-Presse on Saturday, November 14, describing it as one of the largest data leaks ever acknowledged in France.
Maileva is a subsidiary of Docaposte, itself part of the La Poste group. The platform handles business mail for companies and institutions, sending payslips, registered letters, invoices and meeting notices on their behalf. It says it has more than 70,000 users and sent 180 million documents in 2024.
What was taken — and what was not
According to La Poste, the attackers stole the first name, surname and postal address of 22 million recipients of mail sent by Maileva's client companies. The figure already accounts for duplicates: internal documents cited by specialist site cyberattaque.org put the compromised database at roughly 39 million mail references, since one person can receive letters from several different organisations.
La Poste said bank details were not affected, and no other categories of data have been disclosed. There is also no evidence so far that the stolen files have been publicly released or sold. The platform is used by private companies, public institutions, health organisations and government administrations, and several thousand corporate clients are affected.
How the attack unfolded
The intrusion was detected on the morning of September 23, when Maileva interrupted its services after spotting unauthorised access attempts on certain client accounts, which were apparently being used to send mail without their owners' consent. Services resumed on September 29.
Maileva has notified France's data-protection regulator, the CNIL, and filed a formal complaint. A judicial investigation is now underway, though La Poste has not disclosed the attack method, the systems compromised or the identity of the attackers.
One of France's biggest leaks
Specialist sites FrenchBreaches and cyberattaque.org, which first reported the incident, called it one of the largest data breaches ever acknowledged in France. It follows a run of high-profile cyberattacks against French public and private organisations, and the scale of the affected population gives the case weight under French and EU data-protection rules.
For the people affected, the immediate risk is limited to the exposure of names and home addresses, but that is exactly the kind of data used to make phishing and fraud attempts look convincing. Maileva says it has informed the client companies involved, and anyone who received mail through the platform in recent months should treat unexpected messages asking for personal or banking details with extra caution.
