Maileva data breach: intruders accessed names and postal addresses of 22 million people in France
Severity: medium · Patch status: unknown · Since 2026-09-24
Maileva, a document-mailing platform run by Docaposte (La Poste group), suspended all its services on 23 September 2026 after detecting unauthorised access attempts, and restored them on 29 September. Specialist French sites made the incident public on 24 September, citing a message Maileva had sent its clients. Maileva now confirms that identity data (first name, surname and postal address) of 22 million people was stolen. These are recipients of mail sent by Maileva's business clients, not Maileva's own customers. The count is distinct people across a database of 39 million mail references; FrenchBreaches notes it is the accessible scope rather than confirmed downloads. Named victims include social landlords Flandre Opale Habitat and Altéal, the Inovie network of medical laboratories, and Foch Hospital, whose patients received payment reminders (sent through subcontractor Kiwee.care) that carried invoice numbers, care dates and amounts owed. Some client notices also list email addresses, login identifiers and file names. Security Affairs and CNews report that Maileva says bank details were not compromised; FrenchBreaches, citing a Docaposte sheet dated 5 October, says the billing tool held client companies' IBANs. That conflict is unresolved. Maileva says it notified the CNIL and filed a complaint, and a judicial investigation is open. La Poste announced the figure on 14 November. An application flaw is reported as the entry point, but no official statement confirms it. Recipients should expect phishing and fake payment requests that quote real invoice or care details.
What to do
- If you send mail through Maileva, list every mailing it handled (recipient data may go back up to ten years) and notify affected recipients as GDPR requires
- If you receive Maileva-sent letters, treat unexpected payment reminders, bank-detail change requests, or calls quoting invoice numbers, care dates or amounts as suspect; confirm them through the sender's known channel before paying
- Mail-processing vendors: ask for exact data categories, retention period and sub-processor breach status for any platform holding recipient names and addresses; check whether your mailing data flows through Maileva or Kiwee.care
- Watch for updates to the 22 million figure or the data categories: a judicial investigation is open and a supplementary CNIL notice was described as still to follow (per a captured client message)
Sources
All live incidents on Threat Watch
