La Poste Unit Maileva Exposes Data of 22 Million in One of France's Largest Breaches

How a September Breach at Maileva Exposed 22 Million French Addresses

La Poste, France's national postal group and one of the country's largest service conglomerates, confirmed on Saturday 14 November that its subsidiary Maileva was hit by a cyberattack in mid-September. The breach exposed personal data belonging to roughly 22 million people — about a third of the French population — making it one of the largest data leaks ever recorded in the country. A judicial investigation is under way and the case has been reported to the CNIL, France's data-protection authority.

Maileva is not a household name, but it sits quietly at the centre of a lot of French administrative life. The company prints and dispatches professional correspondence — payslips, registered letters, invoices, administrative notifications and shareholder meeting notices — on behalf of small and mid-sized businesses. Its parent, Docaposte, is the digital-services arm of La Poste. Maileva says it has more than 70,000 users and processed 180 million documents in 2024.

The data exposed consists of first names, surnames and postal addresses of people who received mail sent by Maileva's corporate clients — not just the platform's direct customers. La Poste says bank details and other financial information were not compromised. According to the specialist site Cyberattaque.org, those affected include recipients of communications from social-housing organisations such as Flandre Opale Habitat and Altéal, patients of clinical laboratories linked to the Inovie group, and users of the Foch Hospital near Paris. The site reports that an intruder accessed the contents of certain payment-demand letters sent to patients via Kiwee.care, a medical-debt collection firm that uses Maileva — exposing invoice numbers, appointment dates and outstanding amounts.

Maileva says all affected companies were informed in line with French regulations. The incident adds to a growing list of cyberattacks and data leaks that have hit major French companies and public bodies in recent years, and it raises fresh questions about how much sensitive information flows through a small number of outsourced document-processing platforms.

Why La Poste's Document Arm Became France's Softest Cyber Target

Why Maileva Was a High-Value Target

Maileva's business model is precisely what makes it attractive to attackers. It aggregates document flows from thousands of client organisations — housing bodies, laboratories, hospitals, debt collectors — into a single printing and mailing pipeline. That means one intrusion can yield a cross-section of personal data from many sectors at once, rather than the records of a single company. The 22 million figure reflects that multiplier effect: the victims are not Maileva's clients but the individuals those clients write to.

The Kiwee.care Angle Raises the Stakes

The most sensitive element reported so far concerns Kiwee.care, a firm specialising in out-of-court recovery of medical debts. According to Cyberattaque.org, an intruder accessed the contents of certain payment-demand letters, exposing invoice numbers, dates of care and outstanding amounts. If confirmed, that goes beyond names and addresses into information that could be used for targeted phishing or social engineering against patients. Maileva has not confirmed the specifics of that report, and the judicial investigation is ongoing — so this element should be treated as reported but not yet officially verified.

France's Pattern of Breaches

This is not an isolated event. In 2024, health-payment operators Almerys and Viamedis leaked data on more than 33 million people, and the public employment agency France Travail exposed records of 36.8 million users. Last week, Crédit Mutuel Arkéa disclosed a cyberattack with an estimated financial impact of around €100 million. Attacks on the tax administration reportedly compromised data on roughly 700,000 taxpayers, and La Poste itself was targeted in a pro-Russian hack days before Christmas 2025. CNIL data show more than 5,600 personal-data violations in France in 2024, up 20% year on year. For context, analysts attribute France's exposure to the size of its economy, deep digitalisation of public and private services, and its geopolitical stance — including support for Ukraine — which has made it a frequent target of politically motivated hacking.

What This Means for Outsourced Document Processing

The breach puts a spotlight on a segment of the tech-services market that rarely attracts public attention: bulk print-and-mail and document-management providers. These firms handle payroll, invoices, debt notices and administrative correspondence for clients who often assume the vendor's security is adequate. The Maileva case suggests that assumption deserves scrutiny. Clients may now face contractual and reputational questions of their own, particularly in healthcare and social housing, where the data involved is sensitive. Regulators, meanwhile, are likely to look harder at how such platforms segment, encrypt and monitor access to client data.

Short, Medium and Long-Term Consequences

In the short term (0–6 months), expect the judicial investigation to proceed, CNIL to examine Maileva's compliance, and affected organisations to notify individuals. In the medium term (6–24 months), French regulators may tighten expectations for outsourced document processors, and clients may demand stronger contractual security guarantees or bring some functions back in-house. Over the longer term (2–5 years), the cumulative pattern of breaches could push France toward stricter enforcement and higher security spending across both public and private sectors — a cost that will ultimately be passed through to clients and, in some cases, taxpayers.

What the Maileva Breach Means for Clients, Regulators and French Data Security

The Maileva breach shows that outsourcing document handling does not outsource the risk — one vendor's compromise can expose data belonging to millions of people across dozens of client organisations.

For Clients of Maileva and Similar Platforms

• Confirm in writing whether your organisation's mailings were affected, which data fields were exposed, and what Maileva is doing to notify recipients, as required under French regulation.
• Review your vendor contracts for breach-notification timelines, liability caps and security-audit rights — the Maileva case is a template for renegotiation.
• If you operate in healthcare, social housing or debt collection, assess whether the exposed data (invoice numbers, appointment dates, outstanding amounts) could enable targeted phishing against your patients or tenants, and prepare a specific warning to them.

For Executives and Boards

• Map every third party that touches personal data on your behalf, not just your primary IT vendors — print, mail and document-processing providers are often overlooked.
• Ask whether your own incident-response plan covers a breach originating at a supplier, including who communicates to affected individuals and within what timeframe.

Metrics to Watch

• CNIL's formal findings and any sanction against Maileva or Docaposte.
• The scope of the judicial investigation and whether criminal charges follow.
• Whether other Maileva clients — beyond those named by Cyberattaque.org — disclose exposure in the coming weeks.
• Any new French regulatory guidance on outsourced document-processing security.