跳到内容
现在

科技 · Maileva泄露事件

Maileva泄露事件致2200万人的姓名和地址被盗，部分信件泄露更多信息

Maileva重新开放数周后，La Poste证实发生了盗窃。客户通知显示，医院账单和住房信件如何让付款诈骗更具迷惑性。

文字 阅读需 7 分钟 · 48 个来源

HeyDex

原语言视频

译自英文原文。

La Poste证实被盗信息的规模时，Maileva的邮件服务已经恢复运营六周多：涉及2200万人的姓名和邮政地址。9月的停运已经结束，但患者、租户和其他信件收件人面临的后果并未结束。⁠1⁠6

La Poste于2026年11月14日向法新社确认了这一数字，此前一天，Cyberattaque.org公布了总数。受影响者是Maileva企业客户所寄信件的收件人——他们不一定在Maileva开过账户，甚至可能不知道它的存在。数千家客户组织受到影响。⁠10⁠6⁠1

Maileva称银行信息未受影响。但个别客户发布的通知说明，这种保证有其局限：部分可能被访问的信件包含真实的发票编号、就诊日期、应付金额或住房信息。这些细节会让虚假的付款要求看起来像是收件人与确实熟悉的机构之间尚未处理完毕的事项。⁠6⁠8⁠27

2200万姓名和地址被盗的人数 16
约3900万据报在遭入侵数据库中的邮件记录数 1

这两个数字衡量的是不同事物。2200万的总数剔除了重复计算的个人。BigGo Finance援引据称来自Docaposte的内部文件，报告约3900万条邮件记录：一个人可能收到多封信件，其中包括来自不同组织的信件。两个数字都不能证明每位收件人的全部信件都被盗。⁠1

Maileva隶属于Docaposte，而Docaposte是国有La Poste集团的一部分。Maileva负责打印并寄送专业信件，包括发票、缴费提醒、工资单和挂号信。其网站宣传拥有逾70000名用户和20000家客户。这种商业模式将许多原本互不相关的组织的信息集中在一个中间服务商处，也使那些从未选择使用该服务商的人同样受到这起泄露事件的波及。⁠6⁠1⁠20

服务已恢复，泄露事件仍未解决

据称攻击发生在9月中旬；确切的开始日期尚未确定。已有明确记录的是运营应对措施：发现可疑活动和未经授权尝试登录客户账户后，Maileva于9月23日早上7点暂停服务。其早期通报重点提到攻击者试图在未经账户所有者许可的情况下寄出信件。⁠7⁠18

eWatchers转载的一则9月24日信息向一名客户保证，该客户的账户没有遭遇上述登录尝试，而且未发现有人从其客户门户或API账户发送邮件。这是针对特定账户遭滥用尝试的说明，并非认定整个平台的信息仍然保密。该信息没有宣布发生大规模盗窃。⁠18

9月28日的一则平台通知称，平台将逐步重新开放，客户专区及其全部功能当时仍在等待恢复。Cyberattaque.org称，全面运营于9月29日恢复，停摆六天。这些是恢复进程中的不同阶段，并非对同一服务何时重新开放的说法互相矛盾。⁠18⁠10

到10月9日，保密问题逐渐明朗。科努瓦耶的一家职业健康机构披露，有人未经授权访问了一个邮件追踪数据库，其中包含发件人和收件人信息以及相关文件名。该机构无法确认完整信件是否被阅读或提取。即使是这种范围较窄的信息暴露也很重要：医疗服务发件人的身份或透露信息的文件名，即使无人打开文件，也可能泄露个人信息。⁠10

客户通知揭示了什么

苏雷讷的福煦医院提供了目前最清楚的、关于信件内容可能遭到泄露的记录案例。医院使用Kiwee发送缴费提醒，由Kiwee委托Maileva打印并寄出。根据医院11月6日发布的通知，福煦医院于10月28日获悉，部分提醒信内容可能已被查看。⁠8

通知列明了2026年9月9日至9月23日期间收到的提醒信。信中除了姓名和地址，还包含发票编号、就诊日期和应付金额。信件没有描述治疗内容，也不含患者的银行信息。不过，它们会透露某个具名人士曾在福煦医院就诊——医院明确承认，这种关系属于敏感信息。⁠8

福煦医院在发布通知时表示，没有数据被更改或删除。医院已通知法国数据保护监管机构CNIL，向Kiwee和Maileva索取详情，并提醒接待和收费团队。通知称，Maileva已修复漏洞并加强安全措施。这些措施针对的是系统，但并不能证明已找回被访问信息的副本。⁠8

Inovie也披露，旗下多家实验室的部分患者信息保密性受到影响。其通知列出名字、姓氏和邮政地址，并表示支付数据和密码未受影响。关键在于，通知称潜在受影响者名单尚未确定——而不是说一定无法确定这些人的身份。多个实验室网站发布通知，并不意味着每家实验室或每位患者都受到了影响。⁠35⁠10

对住房租户而言，可能泄露的信息可追溯得更久。Flandre Opale Habitat在11月3日的通知中表示，过去十年间寄出的信件中包含的信息可能遭到访问。视信件内容而定，这些信息包括联系方式、客户编号、住房信息，以及发票金额等行政或财务信息。该机构未提供受影响租户人数，并提醒称，发布警告并不意味着某位租户的信息一定被查看或使用。⁠27⁠1

Altéal和Erilia指出，可能泄露的信息包括姓名、性别和邮政地址。两家机构都警告，文件名可能透露个人情况或行政事务，使诈骗信息更具迷惑性。Erilia仍在核查其他档案信息是否曾被查看；当时没有迹象表明银行数据、密码或身份证件遭到泄露。两家机构均已各自向CNIL履行相关手续。⁠16⁠15

服务洛里昂的IZILO交通网络也是受影响客户之一。其披露的泄露信息包括称谓、姓名、邮政地址和相关文件名，不包括银行详情。这些通知共同说明，为什么全国范围内已确认被盗字段的清单无法完整描述每位收件人面临的风险。额外泄露的信息取决于各组织在邮件中放入了什么内容。⁠10

发票无误，并不能证明太多

眼下的直接危险，是利用真实信息冒充他人。虚假的催款通知可能引用真实发票编号、就诊日期或应付金额，然后替换成犯罪分子的收款指示。福煦医院警告称，诈骗者可能通过电子邮件、短信、电话或纸质邮件，冒充医院、Kiwee、医保系统或互助保险机构。即使原服务通过信件投递，纸质信件也并非天然可信。⁠8

目前已知情况有重要局限。Flandre Opale Habitat、Altéal和Erilia发布警告时，均表示尚未发现已知的欺诈使用行为。被盗文件是否公开发布或出售，也尚未得到证实。这些只是证据的局限，并不保证信息不会遭到滥用。⁠27⁠16⁠15⁠1

实用原则是：通过独立获取的联系方式核实意外收到的付款要求，而不要使用消息中提供的号码或链接。福煦医院和Kiwee表示，不会通过电子邮件、短信或电话索要密码、安全码或银行信息。如果已经泄露密码，应立即更改；如果已向诈骗者付款，应立即联系银行并报案。⁠8

这并不意味着可以不支付合法账单。福煦医院仍接受通过其官方在线服务、医院接待处或抬头为association Hôpital Foch的支票付款。直接向医院收费部门获取账户信息后，也可以进行银行转账。关键在于核实付款指示来自谁，而不是要求中是否包含可辨认的信息。⁠8

Maileva已通知CNIL并提起诉讼，司法调查正在进行。La Poste表示，所有受影响企业均已收到通知。这些行动并不能证明监管责任、确定攻击者身份，也不能厘清文件被访问的全部范围。⁠4

通知企业也不能证明2200万人都已收到通知。向收件人发出通知的责任在于他们收到信件所属的组织：医院或实验室、房东、交通运营方。目前仍没有公开的个人通知人数汇总。这起泄露事件尚未解决的部分，不在于Maileva能否再次寄信，而在于收件人是否了解自身信息遭泄露的情况，足以识别足以乱真的假信息。⁠1

来源37

在此处引用的来源中，Cyberattaque.org最先发布，比本报道播出早4天。 随后还有16家媒体发布。
  1. Cyberattaque.org
  2. Nity Pro
  3. Cyberiack
  4. Linternaute.com
  5. Economie Matin
  6. Google News France (FR:fr)
  7. Google News France (FR:fr)
  8. Google News France (FR:fr)
  9. 另有+9家媒体
  10. HeyDay News

13篇早期文章作为背景资料参阅。12家媒体未注明日期：Maileva - Plateforme de confiance numérique pour entreprisesInYourGeekAltéalAnas Sahelerilia.frFlandre Opale Habitat

按媒体查看所有来源

来自 37 家媒体的 48 个来源· 引用最多的优先

播出原貌
  1. Hackers stole names and postal addresses belonging to 22 million people. The victims received letters from businesses using Maileva, including healthcare and housing organizations. Some customer records could give fraudsters real billing details to make a false payment demand convincing.
  2. How much additional information did those letters expose, and how many recipients have been told their data was stolen?
  3. Maileva prints and posts correspondence for companies and public organizations. It operates within Docaposte, part of the state-owned La Poste group. A patient or tenant may never have known that this intermediary handled their letters.
  4. Its work includes invoices, payment reminders, payslips, administrative letters, meeting notices and registered mail. Maileva advertises more than 70,000 users and 20,000 clients. It processed a reported 180 million documents in 2024. Several thousand business customers are affected by this breach.
  5. La Poste's 22 million total removes duplicate individuals. The compromised database reportedly held approximately 39 million mail references. One person can receive several letters, including letters from different organizations using the same provider.
  6. La Poste confirmed the scale on November 14, 2026. The figure had become public the previous day. The service itself had already reopened in September, more than six weeks before that confirmation.
  7. The confirmed stolen fields are first names, surnames and postal addresses. Maileva says bank details weren't affected. Individual customers describe potentially accessible correspondence containing more personal information, including invoice details and the fact that someone received hospital care.
  8. Maileva stopped services on September 23 after suspicious activity and attempts to enter customer accounts without permission. Its early warning focused on an attacker trying to send letters through other people's accounts. The company blocked accounts and halted operations as a precaution.
  9. The suspension began at seven in the morning on September 23. A September 28 message described progressive reopening. Full operations resumed September 29, after six days. La Poste confirmed the 22 million-person scale on November 14.
  10. A September 24 message reassured one customer that its account hadn't suffered those access attempts or sent unauthorized letters. That reassurance concerned that customer's account and attempted misuse. Maileva hadn't announced the large-scale theft then. September 23 marks the shutdown; the attack was described as happening in mid-September.
  11. An occupational-health organization in Cornouaille disclosed access to a mail-tracking database on October 9. Potentially accessible information included sender and recipient identities, postal and email addresses, sender identifiers and filenames associated with letters.
  12. The organization couldn't tell whether anyone had read or extracted its full letters. But a filename or a medical sender's identity can itself reveal something personal. Restoring the ability to send mail hadn't resolved the consequences for information already accessed.
  13. Subscribe to this channel to follow which recipients are notified and what their organizations disclose next.
  14. Hôpital Foch's payment reminders show how personal information passes through several companies. The hospital uses Kiwee to send reminders. Kiwee then asks Maileva to print and post them, placing patients' correspondence inside the breached service.
  15. The hospital learned on October 28 that some reminder contents might have been read. Its November 6 notice identifies reminders received between September 9 and September 23. Alongside names and addresses, those letters contain invoice numbers, dates of care and amounts due.
  16. Foch says the letters don't describe the treatment or contain bank details. They do identify someone as having received care at the hospital. That relationship is sensitive information, even when the letter doesn't reveal a diagnosis.
  17. Foch said no data had been changed or deleted when it issued its notice. It notified France's data-protection regulator, the CNIL, requested details from Kiwee and Maileva, and alerted reception and billing staff. Its notice says Maileva corrected the vulnerability and strengthened security.
  18. Kiwee confirms correspondence for certain healthcare clients was involved. Inovie also says some patients at several laboratories lost confidentiality of their names and postal addresses. Its notice excludes payment data and passwords, and says it hadn't yet identified the potentially affected patients.
  19. Notifications appeared across AXBIO, BioMedilab, Biofusion, CBM, Gen-Bio, Biopyrénées and Labosud. A Novabio communication was reported on November 2. The notices concern some patients; each laboratory's own notification defines its scope. The exposed information passed through the mailing provider.
  20. Flandre Opale Habitat warns that correspondence spanning ten years could have been accessible. Its November 3 notice covers possible exposure of contact details, customer numbers, housing information and administrative or financial information, including invoice amounts.
  21. The provider manages approximately 20,000 homes across 259 communes in Hauts-de-France. It hasn't given an affected-tenant count. It cautions that a tenant's information wasn't necessarily read or used. Tenant-election documents were handled by Paragon and are excluded from this incident.
  22. Altéal and Erilia identify potentially exposed names, gender and postal addresses. Both warn that filenames could disclose someone's circumstances or administrative dealings. A scammer could use that context to make a message about a person's housing file more believable.
  23. Altéal manages more than 14,000 homes in Occitanie; its notification was reported November 9. Erilia was still checking whether other dossier information had been visible. It said nothing then indicated exposure of bank data, passwords or identity documents. Both made their own CNIL filings.
  24. The IZILO transport network in Lorient is also affected. Its exposed information includes forms of address, names, postal addresses and associated filenames. IZILO says bank details weren't involved. Healthcare, housing and transport customers share the consequences of one intermediary's breach.
  25. Flandre Opale Habitat, Altéal and Erilia reported no known fraudulent use when they issued their warnings. Public release or sale of the stolen files hasn't been confirmed. The immediate risk is impersonation using authentic information that a recipient recognizes.
  26. A false reminder can quote a genuine invoice number, care date or amount due, then direct payment to a criminal. Foch warns that scammers could impersonate the hospital, Kiwee, the health-insurance system or a mutual insurer through email, text, telephone or paper mail.
  27. Verify an unexpected demand through contact details you've obtained separately. Don't use the number or link supplied in that message. The correct name, tenancy reference or invoice amount doesn't prove that the person asking for money is entitled to receive it.
  28. Foch and Kiwee say they won't ask for a password, security code or bank details by email, text or telephone. If you've given a scammer a password, change it. If you've paid a fraudster, contact your bank immediately and file a complaint.
  29. Foch still accepts legitimate payments through its official online payment service, hospital reception, or a cheque payable to association Hôpital Foch. Bank transfers are also possible after obtaining the hospital's bank-account details directly from its collections service. Verify substituted payment instructions before sending money.
  30. Maileva has notified the CNIL and filed a complaint. A judicial investigation is underway. La Poste says all affected businesses have been informed. Those organizations must assess their notification obligations and communicate with the people whose information they handle.
  31. A patient may hear from a hospital or laboratory, a tenant from a landlord, and a passenger from a transport operator. The confirmed nationwide theft covers names and addresses. Additional exposure depends on each customer's letters. There's still no consolidated public count of how many of the 22 million people have actually been notified.

译文更新于

近期播出