Maileva breach stole 22 million people’s names and addresses. Some letters exposed more

La Poste confirmed the figure to AFP on November 14, 2026, a day after Cyberattaque.org published the total. The victims were recipients of correspondence sent by Maileva’s business customers—not necessarily people who had opened an account with Maileva, or even knew it existed. Several thousand customer organizations are affected.⁠10⁠6⁠1

Maileva says bank details were not affected. But notices from individual customers show why that reassurance has limits: some potentially accessible letters contained genuine invoice numbers, care dates, amounts due or housing information. Those details can make a fraudulent payment demand look like unfinished business with an organization the recipient actually knows.⁠6⁠8⁠27

The two counts measure different things. The 22 million total removes duplicate individuals. BigGo Finance reports approximately 39 million mail references, citing internal documents attributed to Docaposte: one person may receive several letters, including from different organizations. Neither count establishes that every recipient’s complete correspondence was stolen.⁠1

Maileva operates within Docaposte, part of the state-owned La Poste group. It prints and posts professional correspondence, including invoices, payment reminders, payslips and registered letters. Its website advertises more than 70,000 users and 20,000 clients. That business model places information from many otherwise separate organizations inside one intermediary—and puts people who never chose that intermediary within reach of the same breach.⁠6⁠1⁠20

The attack is described as occurring in mid-September; its exact starting date has not been established. What is documented precisely is the operational response: Maileva suspended services on September 23 at 7 a.m., after suspicious activity and unauthorized attempts to enter customer accounts. Its early communication focused on an attacker trying to send letters without the account owners’ permission.⁠7⁠18

A September 24 message reproduced by eWatchers reassured one customer that its account had not suffered those access attempts and that no outgoing mail had been detected from its customer portal or API account. That was an account-specific statement about attempted misuse—not a finding that information across the platform remained confidential. No mass theft was announced in that message.⁠18

A September 28 platform notice described progressive reopening, with access to the customer area and its full functions still awaiting restoration. Cyberattaque.org reports that full operations resumed September 29, after six days. These were stages of recovery, not competing accounts of when the same service reopened.⁠18⁠10

By October 9, the confidentiality problem was becoming clearer. An occupational-health organization in Cornouaille disclosed unauthorized access to a mail-tracking database containing sender and recipient information and associated filenames. It could not establish whether its full letters had been read or extracted. Even that narrower exposure matters: a medical sender’s identity or a revealing filename can disclose something personal without anyone opening the document.⁠10

Hôpital Foch in Suresnes provides the clearest documented example of potentially exposed letter contents. The hospital uses Kiwee to send payment reminders; Kiwee has Maileva print and post them. Foch learned on October 28 that some reminder contents might have been consulted, according to its November 6 notice.⁠8

The notice identifies reminders received between September 9 and September 23, 2026. Alongside names and addresses, they contain invoice numbers, dates of care and amounts due. They do not describe the treatment or contain patients’ bank details. They do, however, reveal that a named person received care at Foch—a relationship the hospital explicitly recognizes as sensitive information.⁠8

Foch said no data had been changed or deleted when it issued its notice. It notified France’s data-protection regulator, the CNIL, requested details from Kiwee and Maileva, and alerted reception and billing teams. Its notice says Maileva corrected the vulnerability and strengthened security. Those measures address the system; they do not establish that copies of accessed information have been recovered.⁠8

Inovie has also disclosed a loss of confidentiality affecting some patients at several laboratories. Its notice identifies first names, surnames and postal addresses, while excluding payment data and passwords. Crucially, it says the list of potentially affected people had not yet been established—not that identifying them would necessarily be impossible. Notifications across multiple laboratory websites do not mean every laboratory or every patient was affected.⁠35⁠10

For housing tenants, the possible exposure can reach much further back. Flandre Opale Habitat’s November 3 notice says information in correspondence sent over the preceding ten years could have been accessible. Depending on the letter, that includes contact details, customer numbers, housing information and administrative or financial information such as invoice amounts. It has not supplied an affected-tenant count, and cautions that the warning does not mean a particular tenant’s information was necessarily consulted or used.⁠27⁠1

Altéal and Erilia identify potentially exposed names, gender and postal addresses. Both warn that filenames could reveal personal circumstances or administrative dealings, making a fraudulent message more convincing. Erilia was still checking whether other dossier information had been visible; nothing then indicated exposure of bank data, passwords or identity documents. Both recorded their own CNIL formalities.⁠16⁠15

The IZILO transport network serving Lorient is another affected customer. Its disclosed exposure includes forms of address, names, postal addresses and associated filenames, rather than bank details. Together, these notices show why the nationwide list of confirmed stolen fields cannot fully describe every recipient’s risk. The additional exposure depends on what each organization put into its mail.⁠10

The immediate danger is impersonation using authentic information. A false reminder can quote a genuine invoice number, care date or amount due, then substitute a criminal’s payment instructions. Foch warns that fraudsters could pose as the hospital, Kiwee, the health-insurance system or a mutual insurer through email, text, telephone or paper mail. Paper correspondence is not inherently trustworthy simply because the original service delivered letters.⁠8

There are important limits to what is known. Flandre Opale Habitat, Altéal and Erilia reported no known fraudulent use when they issued their warnings. Public release or sale of the stolen files has not been established. Those are limits on the evidence, not guarantees that misuse cannot occur.⁠27⁠16⁠15⁠1

The practical rule is to verify an unexpected demand through contact details obtained independently, not the number or link supplied in the message. Foch and Kiwee say they will not ask for passwords, security codes or bank details by email, text or telephone. If a password has been disclosed, change it; if money has been paid to a fraudster, contact the bank immediately and file a complaint.⁠8

This does not mean legitimate bills should go unpaid. Foch still accepts payments through its official online service, hospital reception or a cheque payable to association Hôpital Foch. Bank transfers are possible after obtaining the hospital’s account details directly from its collections service. The essential check is who supplied the payment instructions—not whether the demand contains recognizable information.⁠8

Maileva has notified the CNIL and filed a complaint, and a judicial investigation is underway. La Poste says all affected businesses have been informed. Those actions do not establish regulatory liability, identify the attacker or settle the full extent of document access.⁠4

Nor does informing businesses establish that all 22 million people have been reached. Recipient communication falls to the organizations whose correspondence they received: a hospital or laboratory, a landlord, a transport operator. There is still no consolidated public count of individuals notified. That is the unfinished part of this breach: not whether Maileva can send letters again, but whether recipients know enough about their own exposure to recognize a convincing fake.⁠1