Data theft at Maileva: 22 million addresses exposed without victims being notified
La Poste subsidiary Maileva suffered a cyber attack exposing the names and addresses of 22 million people. Many remain unaware they are affected.
Maileva cyber attack: millions of recipients affected without their knowledge
Twenty-two million names and postal addresses were stolen from Maileva, a La Poste subsidiary specialising in dematerialised letter delivery, reveals jechange.fr. What is distinctive about this breach: the victims are not Maileva's clients, but the recipients of their letters — tenants, patients, employees, service users — who have never had any contractual relationship with this company.
La Poste group confirmed the incident on 14 November, two months after the initial breach. Maileva prints and delivers on behalf of thousands of businesses and organisations payslips, invoices, registered letters and general assembly convocations. The company claims more than 70,000 users and 180 million documents sent in 2024. Each piece of correspondence passing through its platform carried the name and address of its recipient, and part of these files was exfiltrated.
The extent of the breach revealed late
La Poste group officially mentions "exposure of the contact details (first name, surname, postal address) of 22 million people". This figure only emerged well after initial alerts. At the end of September, Maileva was still mentioning only attempted access to client accounts and fraudulent letter dispatches.
According to internal documents cited by the cyberattaque.org website, the stolen database would contain approximately 39 million letter references, reduced to 22 million people once duplicates were removed. Maileva notified the National Commission for Informatics and Liberty (CNIL) and filed a complaint. A judicial investigation is underway. The affair is part of a recent series of data breaches, following those affecting Engie and Crédit Mutuel Arkéa.
A legal gap leaves victims without direct information
The General Data Protection Regulation (GDPR) distinguishes between the data controller and the processor. Maileva acts as a processor: it handles addresses on behalf of its business clients. It is obliged to inform these clients, but it is they — not Maileva — who bear the obligation to notify the individuals concerned. Maileva confirms this itself in its communications: informing recipients falls under the responsibility of its clients, which it claims to have all warned.
However, Maileva has "several thousand" client companies concerned, and publishes no report of notifications actually sent to individuals. The regulatory text also leaves room for interpretation by organisations regarding the timeframes and manner of notification.
Some clients have nevertheless taken action. Social housing landlords such as Flandre Opale Habitat and Altéal, Foch hospital in Suresnes or medical analysis laboratories have published their own notices between 9 October and 9 November. These communications show that some letters contained more than a simple postal address.
Concrete risks: paper mail, an underestimated fraud vector
A stolen postal address opens up different possibilities from an email address. It allows someone to send a paper letter in the correct name, imitating the organisation from which the recipient would be expecting communications. Paper mail generally inspires more trust than an email and escapes spam filters.
Combined with other data — an invoice reminder, a customer number or a treatment date — the letter becomes even more credible. Scenarios to watch for in the coming weeks: fraudulent payment demands imitating a landlord, health insurance company or operator; fake letters from a laboratory or hospital preceding an attempt to divert health insurance reimbursements; or attempts to build fraudulent cases combining this data with other previous breaches.
A name and address alone are not enough to take out credit. Combined with other information available through previous breaches, however, they can contribute to the elaboration of a fraudulent application. The Bank of France's reimbursement incident file remains freely accessible to verify any credit taken out without knowledge.
How to protect yourself in the absence of a public list of victims
No public list currently allows verification of whether an address is among the stolen data. Jechange.fr recommends treating as suspect any mail requesting payment or personal information, and verifying its authenticity directly with the sending organisation using its official contact details — not those appearing in the letter received.
If a transfer has already been made, contacting one's bank without delay remains the priority course of action. An unauthorised transaction opens entitlement to reimbursement, unlike a transfer validated voluntarily by the account holder.
Some home insurance policies include legal protection or a guarantee against identity theft, capable of covering lawyer fees or administrative procedures if a policyholder's name is used for fraudulent purposes, provided this option is included in the contract.
For any doubt about mail from a healthcare organisation, the organisation's official online space or its usual telephone number constitutes the reliable source of information: an authentic invoice is as a rule accessible there.
Source: Google News LU FR