La Poste subsidiary Maileva hacked, contact data of 22 million people stolen

What was stolen

Maileva, a subsidiary of Docaposte and therefore part of the La Poste group, was hit by a hacker attack in mid-September 2026. According to La Poste, the intrusion led to the theft of the contact details of 22 million people. The company serves professionals, small and medium-sized businesses and large organisations, and it manages the full life cycle of documents such as registered letters, payslips, invoices and notices for general meetings. Maileva counts more than 70,000 active users and sent 180 million documents in 2024. The articles do not say how the intruders gained access to the systems.

Disclosure and response

La Poste announced the breach on Saturday, 14 November, and confirmed to news agencies that it is one of the most serious data breaches in France. The group said Maileva had informed the CNIL, the French data protection authority, and filed a complaint. In a statement given to AFP, La Poste said:

“Maileva has notified the CNIL and filed a complaint. A judicial investigation is under way.”

Maileva said all businesses concerned had been informed, in line with the regulations. The cyberattack monitoring website cyberattaque.org, whose information La Poste confirmed, described the leak as one of the largest in France.

Earlier incidents at La Poste

Coverage also points to earlier problems for the group. During the Christmas period of 2025, a cyberattack claimed by pro-Russian hackers significantly slowed its parcel-tracking system, in the busiest weeks of the year. Crédit Mutuel Arkéa has also reported a cyberattack with an estimated economic impact of around 100 million euros. Early in 2024, France Travail suffered a large-scale attack that put personal data relating to 43 million people at risk of spreading. The articles do not link these cases to the Maileva breach.

Open questions

La Poste's announcement says the stolen information has been published. The coverage does not detail what kinds of contact data were taken beyond the figure of 22 million. The articles do not say how many of the affected people are French or whether they are customers of the businesses that use Maileva. The gap between the mid-September attack and the November disclosure has drawn controversy. A judicial investigation is ongoing, and the articles report no outcome or attribution.