Hackers accessed the personal data of 22 million people in a cyberattack targeting Maileva, a subsidiary of French postal group La Poste, in one of the largest reported data breaches in France.
The attack took place in mid-September, but the full scale of the breach has only now become known, raising concerns over the security of digital systems handling large volumes of personal information.
According to France 24, the stolen information includes the names, surnames and postal addresses of 22 million people. The affected individuals were recipients of letters or other documents sent by companies using Maileva's services.
La Poste confirmed the cyberattack to AFP following reports by specialist website cyberattaque.org, which described the incident as one of the largest data breaches recorded in France.
The case has been referred to the relevant data protection authorities, while a judicial investigation is under way into the circumstances surrounding the attack.
What data was exposed?
La Poste said the hackers gained access to identification and contact information, specifically the names and postal addresses of 22 million mail recipients.
There is currently no indication that passwords, banking details or the contents of letters and documents processed through the platform were compromised.
Maileva is a digital service operated by the French postal system that allows businesses to manage and send corporate correspondence electronically without handling the physical mailing process themselves.
The platform is used to send invoices, payslips, registered letters, notices of shareholder meetings and other corporate documents.
Its customer base consists mainly of small, medium-sized and larger businesses that use the system to manage high volumes of correspondence.
More than 70,000 users
Maileva is a subsidiary of Docaposte, which is owned by La Poste. It has more than 70,000 users and processed about 180 million documents in 2024 alone.
The scale of those operations helps explain why the cyberattack had such widespread consequences.
However, the 22 million affected individuals were not necessarily registered Maileva users. Most were recipients of letters and documents sent through the platform by businesses and organisations.
La Poste said all affected business customers had been informed of the incident by Maileva in accordance with legal requirements.
French data protection authority notified
After detecting the breach, Maileva notified France's National Commission on Informatics and Liberty (CNIL), the country's independent data protection watchdog.
The company also filed an official complaint with the authorities, triggering a judicial investigation.
No details have been released regarding the identity of the attackers, how they infiltrated the systems, whether the data has been offered for sale, or whether a ransom demand was made.
Authorities have also not said whether the attack has been linked to a known cybercriminal group.
Latest in a series of cyberattacks
The disclosure comes amid a series of cybercrime incidents targeting French companies and public bodies.
Last year, days before Christmas, La Poste was also targeted in a cyberattack claimed by pro-Russian hackers.
Last week, banking group Crédit Mutuel Arkéa said it had been targeted in an attack that resulted in fraudulent transactions worth about 100 million euros. The bank said the attackers used a corporate account rather than customer accounts and that part of the funds had already been recovered.
An even larger breach occurred in early 2024 when public employment agency France Travail suffered a cyberattack that exposed the personal data of about 43 million people.
The Maileva case highlights the risks associated with concentrating vast amounts of personal information on digital platforms. Even data such as names and addresses, while not especially sensitive in isolation, can be used in targeted fraud and phishing attempts.
According to cyberattaque.org, affected individuals are expected to be notified through Maileva's business customers, depending on the legal obligations arising from the breach.
Source: France 24, AFP, cyberattaque.org
