Cyberattack on Maileva (La Poste): 22 million people affected by data theft
La Poste's subsidiary specialising in the dispatch of professional mail was hacked in mid-September. Names, forenames and postal addresses of 22 million people were stolen.
Massive data theft at Maileva, La Poste subsidiary: 22 million victims identified
Maileva, a professional mail dispatch platform and subsidiary of the La Poste group, suffered a cyberattack in mid-September that resulted in the theft of contact details belonging to 22 million people, according to an announcement made on Saturday 14 November. Franceinfo.fr reports that La Poste confirmed the incident, clarifying that Maileva "has notified the National Commission for Data Protection and Liberties (CNIL) and filed a complaint" and that "a judicial investigation is underway".
Personal data stolen on a massive scale
The specialised cyberattack website cyberattaque.org, whose information has been confirmed by La Poste, describes the incident as "one of the most significant data breaches in France". According to the same source, the stolen information includes "names, forenames and postal addresses" of the people affected.
The attack does not affect only individuals: "several thousand business customers" of Maileva are also targeted, particularly in the sectors of social housing, health and public services. La Poste said that, "in accordance with regulations, all affected companies have been informed of the incident by Maileva".
Maileva, a key player in professional mail in France
Maileva is a subsidiary of Docaposte, itself a subsidiary of the La Poste group. It positions itself as a platform dedicated to the dematerialised dispatch of documents for SMEs and medium-sized enterprises: payslips, registered letters, invoices, general assembly notices. The company claims more than 70,000 users and states that it has processed 180 million documents in 2024.
The scale of the breach is explained by the very nature of Maileva's activity: by centralising the postal dispatches of thousands of companies to their clients and employees, the platform necessarily holds a considerable volume of up-to-date postal addresses, covering a significant portion of the French population.
Judicial investigation opened, fraud risks identified
The CNIL was notified of the data breach in accordance with obligations imposed by the General Data Protection Regulation. A complaint was also filed, opening the way to a judicial investigation whose details have not yet been clarified publicly.
The cyberattaque.org website highlights the risk of fraud resulting from the disclosure of such data: precise and up-to-date postal addresses can indeed be exploited for purposes of identity fraud or targeted phishing by physical mail. Maileva's business customers, particularly those operating in the sensitive sectors mentioned, are urged to remain vigilant against potential attempts to exploit the stolen information.
Source: Google News LU FR