Paris prosecutors confirmed on Sunday, November 15, 2026, that they have opened an investigation into a mid-September cyberattack on Maileva. Maileva, an online platform that prints and mails letters for businesses in France, is part of La Poste, the French postal service. The day before, La Poste told the French news agency AFP that the full names and postal addresses of 22 million people had been stolen. All of them had received letters from Maileva’s client companies.
Docaposte, La Poste’s digital subsidiary and Maileva’s owner, had already given client companies that figure in a notice dated October 5. FrenchBreaches, a French website that tracks data breaches, published excerpts on October 9. The notice also describes a second part of the breach, which affects the client companies themselves. It lists their billing contacts, their invoice amounts and their bank account numbers (IBANs, the standard account number format in Europe).
Maileva says on its website that it serves 20,000 clients, small and midsize companies in the public and private sectors, and that it sent 180 million documents in 2024. The intrusion hit that service provider and, through it, reached its clients’ data. The same pattern showed up in the exposure of Notion AI chats at Fireworks AI, one of Notion’s vendors, confirmed on November 9.
Paris cybercrime unit takes the case
The cybercrime section of the Paris prosecutor’s office opened the investigation, according to France’s public broadcasters ICI and franceinfo, both citing AFP. The offense under investigation is “atteinte à un système de traitement automatisé de données,” which covers unauthorized access to a computer system under French law. The case went to the BL2C, a specialized police unit that investigates cybercrime. No suspect, arrest or claim of responsibility has been made public.
La Poste had already told AFP on Saturday, November 14, that “a judicial investigation” was “underway.” According to franceinfo, Maileva says it notified the CNIL, France’s data protection authority, and filed a criminal complaint. It adds that “all the companies concerned have been informed of the incident.” Quotes from French sources in this article are our translation.
A separate cyberattack on La Poste’s online services in December 2025 disrupted access to its bank, La Banque Postale, and to parcel tracking, franceinfo notes.
The 22 million are letter recipients
Maileva’s management describes the people affected as “recipients of Maileva’s client companies.” ICI points out that those companies use Maileva to send pay stubs, registered letters, invoices and notices of general meetings. For these recipients, other personal information, such as bank details, was not affected, according to the management statement La Poste passed on to AFP.
The October 5 notice explains how Maileva arrived at that number. Its mail-tracking database covers the current year and, depending on the client’s contract, up to ten years of mailings. It holds 39 million mail records. Once repeat letters to the same person are removed, Maileva counts 22 million recipients across all its clients.
ICI and franceinfo rank the attack among the largest in France. The early 2024 attack on France Travail, the French public employment agency, was larger: it put the data of 43 million people at risk, franceinfo notes.
The October 5 notice confirms unauthorized access
The notice confirms “unauthorized access to the mail-tracking database.” Docaposte’s group data protection officer sent it to Maileva’s client companies. A data protection officer, or DPO, oversees compliance with the GDPR, the European Union’s data protection law. The notice is aimed at the clients’ own DPOs and IT security managers, but it says it “may nevertheless serve as a basis for your internal or external communications.”
Maileva says it is the data controller for some of its data processing, meaning it decides how that data is used. For recipients’ data, it says it acts “as a processor,” handling the data on behalf of its clients.
The notice describes two sets of data. For letter recipients, it lists gender, last name, first name and postal address. Senders are the people at client companies who use Maileva to send letters. For them, it lists the account holder’s name, the account login, the email address linked to the sender and the name of the file associated with the letter.
The billing data includes client companies’ IBANs
The third set of data comes from OpenCell, a separate application Maileva uses to bill for its services. The notice says “this breach does not concern your end customers,” meaning the letter recipients. This part concerns the client companies themselves: details identifying their billing contacts, invoice amounts and IBANs.
For this billing data, Maileva is the data controller and says it has already notified the CNIL. The notice warns clients: “It is your responsibility to be vigilant about phishing attempts, or CEO / CFO fraud.” In CEO fraud, a scammer poses as an executive or a finance manager to get an employee to wire money.
From “access attempts” in September to 22 million in November
In late September, Docaposte described only a “cybersecurity incident, characterized by unauthorized attempts to access the platform,” according to Solutions Numériques, a French tech news site. The site reported that the platform was shut down for all clients from 7 a.m. on September 23 until September 29, 2026.
Maileva’s message to its clients mentioned attempts “to send illegitimate mail.” Solutions Numériques pointed to a risk that fake letters could go out in the name of real companies. The scenario resembles the UpdraftPlus breach, which involved a WordPress backup tool: keys stolen from its developer were used to plant backdoors on its users’ sites.
According to FrenchBreaches, which saw the notice, the first suspicious activity came on September 9, the attack was detected on September 16 and 17, and the CNIL was notified at 6 p.m. on September 23. La Poste publicly confirmed the 22 million figure on November 14, 40 days after the date on the notice.
Hospital and landlord notices list more exposed data
Two organizations whose letters went through Maileva have published notices that list more data than Docaposte’s. Hôpital Foch, a hospital in Suresnes, near Paris, sends its payment reminders through a company called Kiwee, which has them printed and mailed by Maileva. In a notice to patients, the hospital says it learned on October 28 that the contents of those letters may have been viewed. For reminders received between September 9 and 23, 2026, those contents include the invoice number, the date of treatment and the amount due, along with the patient’s name and address.
The notice, signed by the hospital’s director general, Jacques Léglise, says the letters show that the recipient was treated at Hôpital Foch, and it calls that “sensitive information.” The letters do not mention the type of treatment or any bank details. The hospital reported the incident to the CNIL. It warns of fake messages claiming to come from the hospital, Kiwee, France’s national health insurance system or a supplemental health insurer.
Flandre Opale Habitat, a French social housing landlord, published its own list on November 3. It covers letters sent “over the last 10 years”: names, postal and email addresses, customer numbers and financial information “such as an invoice amount.” The landlord adds that this “does not mean that your data has necessarily been viewed or used.”
Docaposte’s notice, by contrast, limits recipients’ data “at this stage” to gender, last name, first name and postal address. According to FrenchBreaches, the notice does not confirm that the full contents of the letters were viewed.
Open questions
As of November 15, how the attacker got in has not been publicly detailed, franceinfo notes. Citing the notice, FrenchBreaches says the attacker exploited an “application flaw,” a defect in the platform’s software, but gives no further detail. The attacker has not been publicly identified. None of the sources cited here says whether the data is for sale.
The number of client companies affected has not been published. It is also unknown whether the 22 million recipients will be notified individually. On September 30, Solutions Numériques noted that it was unclear whether any fraudulent letters had been sent.
What it means
The case affects three separate groups. The first is the 22 million letter recipients. According to franceinfo, one of the main risks is that they receive fake letters. Antoine Hautin, secretary general of the French cybersecurity firm Almond, told franceinfo that AI makes it possible to automate such fraud campaigns.
The second group is the senders at client companies, whose logins and email addresses appear in the notice. The third group is the client companies themselves. Their billing contacts, invoice amounts and IBANs could feed CEO fraud, a risk the notice itself flags.
Maileva’s statement that bank details were not affected, reported by AFP, is about the recipients. The IBANs in the notice belong to the client companies, so the two statements cover different groups.
For recipients’ data, Maileva describes itself as a processor. According to franceinfo, the GDPR makes the companies concerned responsible for informing their own customers. Hôpital Foch and Flandre Opale Habitat have informed their patients and tenants.
The case also shows the risk of depending on a single provider. In late September, all of Maileva’s clients lost their mailing tool for six days. Some Microsoft 365 users likewise lost access to their email during the mid-November outage.
Still pending are the outcome of the prosecutors’ investigation, the CNIL’s follow-up on the notifications it received, and notices from other client companies about what their letters contained. Docaposte also warned that the information in its notice “may be supplemented or updated.”
Sources
- Maileva (groupe La Poste) : 22 millions de personnes touchées par une cyberattaque, FrenchBreaches, with excerpts of the Docaposte information notice dated October 5, 2026, October 9, 2026
- Cyberattaque contre Maileva, filiale de La Poste : la Brigade de lutte contre la cybercriminalité chargée de l’enquête, ICI (Radio France), November 15, 2026
- « Des courriers ont pu être lus » : ce que l’on sait de la cyberattaque contre Maileva, filiale de La Poste, qui a conduit au vol de données de 22 millions de personnes, franceinfo, November 15, 2026
- Violations de données Maileva-Kiwicare, Hôpital Foch, accessed November 15, 2026
- Information : incident de sécurité chez notre prestataire Maileva, Flandre Opale Habitat, November 3, 2026
- Cyberattaque Maileva : six jours de coupure après une tentative de détournement de la plateforme, Solutions Numériques, September 30, 2026
- Plateforme d’envoi de courriers simples, recommandés en ligne, documents sensibles, Maileva, accessed November 15, 2026
Header image: MACCUS diagram. Data: Docaposte notice to Maileva clients, October 5, 2026, published by FrenchBreaches
