A cyberattack on Maileva, a subsidiary of France's La Poste, exposed the names and postal addresses of 22 million people, the postal group confirmed on Saturday.

The breach, which occurred in mid-September, affected recipients of mail sent by Maileva's corporate clients. The 22 million people were not necessarily registered users of the platform. Maileva, which handles printing and dispatch of payslips, invoices and registered letters for more than 70,000 companies, processed 180 million documents in 2024. The exposed data includes first names, last names and postal addresses; bank details were not compromised.

Hackers first showed suspicious activity on September 9. Maileva detected the intrusion on September 16 and 17 after the attacker exploited a flaw in its software. The company cut its services on September 23 at 7 a.m. after spotting unauthorized access attempts to client accounts. Services resumed on September 29 after a six-day outage.

According to the specialist site Cyberattaque.org, those affected include tenants of social housing landlords such as Flandre Opale Habitat and Altéal. Patients of medical laboratories including Inovie AXBIO, BioMedilab and Biofusion were also exposed. In the case of Foch hospital in Suresnes, a hacker accessed the content of some payment reminder letters. These contained invoice numbers, dates of care and amounts due. The hospital's data was stolen via Kiwee.care, a medical debt collection company that uses Maileva for printing and sending mail.

Maileva's billing tool was also hit. The IBANs of client companies, their invoice amounts and accounting contact details were exposed. Individuals are not affected by this part, but companies should beware of fraudulent transfer requests, according to internal documents attributed to Docaposte.

Maileva notified the CNIL, France's data protection authority, and filed a complaint. "A judicial investigation is ongoing," the company said. In compliance with regulations, Maileva informed all affected client companies of the incident. The 22 million figure already accounts for duplicates; the database contains around 39 million mail references.

The breach ranks among the largest in France. France Travail reported an intrusion in March 2024 potentially affecting 43 million people, including social security numbers. In 2024, third-party payment operators Almerys and Viamedis suffered a theft affecting more than 33 million French people. The CNIL recorded more than 5,600 data breaches in France in 2024, a 20 percent increase from the previous year.

La Poste was already hit by a cyberattack claimed by pro-Russian hackers a few days before Christmas 2025. To date, there is no evidence that the stolen Maileva files have been publicly distributed or resold.