Maileva (Docaposte, La Poste group): mail-tracking data of about 22 million people accessed

How it happened

Per the Docaposte notice, an external attacker exploited an application flaw to reach Maileva's production information system. First suspicious activity dates from September 9. Early communications only mentioned unauthorized access attempts to send illegitimate mail. How the flaw was found and used is not public.[1][2][3] Checked 8 Nov 2026

What was stolen

The notice lists a mail-tracking database of 39 million mail references, about 22 million people once duplicate recipients are removed. Recipients: gender, first and last name, postal address. Senders: name tied to the account, login, email address and the file name linked to a mail item. The billing application also held billing contacts, invoice amounts and client companies' IBANs. The notice does not confirm that letter contents or attachments were viewed or taken, and the scope of extraction was still being investigated on October 5. On November 13, Maileva told Cyberattaque.org that 22 million people are affected by "the theft of their identification data: first name, last name, postal address".[1][10] Checked 13 Nov 2026

Who was impacted

All Maileva clients had their services stopped on September 23; Docaposte says services were fully operational again on September 29. Depending on the contracts, the data can go back up to ten years. Downstream, the social landlord Flandre Opale Habitat (letters over the last ten years, notice of November 3, CNIL notified) and laboratories of the Inovie group such as Novabio (patients' names and addresses, notice of November 2) have warned their own people. Since then, Hôpital Foch (payment reminders with patients' names, addresses, invoice amounts and care dates, notice of November 6) and the social landlord Altéal (tenants' names, gender and addresses, letter of November 10) have done the same; neither gives a number. Flandre Opale Habitat says ten years does not mean all letters were viewed or taken. Maileva says "several thousand" of its client companies are concerned.[1][3][4][5][6][7][8][9][10] Checked 13 Nov 2026

Threat actor

Not attributed

Timeline

1. 9 Sept 2026First suspicious activity on Maileva's system, according to the Docaposte notice. [1]
2. 23 Sept 2026Maileva stops its services at 7:00 after unauthorized access attempts, blocks the affected accounts and files a complaint. [2][3]
3. 24 Sept 2026Cyberattaque.org and FrenchBreaches reveal the incident from a message Maileva sent to its clients. [2][3]
4. 29 Sept 2026Docaposte's press service says Maileva services are fully operational again. [3]
5. 5 Oct 2026Docaposte's data-breach notice confirms access to a database holding personal data: about 22 million people, plus billing data. [1]
6. 2 Nov 2026Novabio (Inovie group) tells patients that some of their names and addresses were exposed through Maileva. [6]
7. 3 Nov 2026Flandre Opale Habitat warns tenants that letters sent over the last ten years may have been accessed, and notifies the CNIL. [4][5]
8. 6 Nov 2026Hôpital Foch (Suresnes) posts a note to patients: payment reminders sent from September 9 to 23 by its billing contractor Kiwee through Maileva were exposed, with names, postal addresses, invoice numbers and amounts, and care dates, but no bank details or nature of care. It says it learned of it on October 28 and notified the CNIL. [7][8]
9. 10 Nov 2026Altéal, a social landlord in Colomiers, tells tenants of a data breach at Maileva: names, gender and postal addresses may have been compromised. It says its own systems were not attacked. [9]
10. 13 Nov 2026In a written reply to Cyberattaque.org, Maileva says 22 million people are affected by the theft of their first name, last name and postal address, and that several thousand client companies are concerned. It says it notified the CNIL and filed a complaint, and that a judicial investigation is under way. It does not detail how the attackers got in. [10]