Maileva, a subsidiary of Docaposte and the La Poste group, was the victim of a large-scale cyberattack in mid-September. La Poste announced on Saturday, November 14, that the contact details of 22 million people had been stolen.
The case ranks among the most significant cyberattacks committed in France. It has revived concerns about the security of personal data and the risks of scams.
According to the company, the exposed data are first name, last name, and postal address. All of the people affected are recipients of Maileva's client companies. The subsidiary says that no bank details were stolen.
Little known to the general public, the platform specializes in sending and managing mail and professional documents. In particular, it prints and dispatches pay slips, invoices, and registered letters.
Maileva claims more than 70,000 users and 180 million documents sent in 2024, according to its website. It works for large companies, but also for public institutions, social housing providers, and hospitals.
In its statement, Maileva said it had notified the Commission nationale de l'informatique et des libertés and filed a complaint."In accordance with the regulations, all of the companies concerned were informed of the incident by Maileva,"the company added.
One of the main risks is the sending of fraudulent mail to people whose contact details were stolen. Using this data, a scammer could produce fake letters in a company's name and claim to be following up on a payment.
A landlord said the incident may have led to unauthorized access to personal data contained in letters sent over the past ten years. A hospital added that these letters mention neither the nature of the care nor bank details, and urged people to be wary of"any request for money that appears to come from the hospital.".
"We are no longer in control of our data,"one of them said. Another added:"It's one more attack, and we can see that there are still a lot of problems surrounding our personal data, no matter the organization.".
This is not the first time the La Poste group has been hit by a large-scale cyberattack. In December 2025, a few days before Christmas, the company was the victim of a massive cyberattack on its online services, claimed by pro-Russian hackers.
Beyond La Poste, computer attacks have multiplied in recent months against companies and public bodies. In early 2024, France Travail was the target of a massive attack, with a risk of personal data being disclosed concerning 43 million people.