By 
In mid-September, La Poste subsidiary Maileva became the target of a significant cyberattack, compromising the personal information of around 22 million individuals in France. This breach is among the largest that the country has experienced and has raised serious concerns about data security within third-party vendors. La Poste has confirmed the breach to various media outlets, including AFP.
The data exposed consists primarily of names and postal addresses belonging to individuals who received documents distributed by Maileva on behalf of various client companies. However, it’s crucial to note that the individuals affected are not Maileva's direct customers; rather, they are the recipients of payslips, invoices, and registered letters sent via the platform. Maileva, a part of Docaposte, serves over 70,000 users and handled approximately 180 million documents in 2024.
Among the entities affected are social housing providers like Flandre Opale Habitat and Altéal, alongside several medical laboratories associated with the Inovie group, including AXBIO, BioMedilab, and Biofusion. Notably, patients linked to Foch Hospital in Suresnes were also caught in the data spill through a subcontractor, Kiwee.care, which facilitates medical billing and debt collection services by printing and mailing documents using Maileva's services. This narrowed focus on Kiwee.care reveals a worrying aspect of the breach, where some of the exposed documents contained sensitive details like invoice numbers, treatment dates, and amounts owed.
As a response to the incident, Maileva promptly notified the French data protection authority, CNIL, and initiated a criminal complaint. A judicial investigation into the breach is currently underway, with Maileva assuring that all parties potentially affected have been informed. However, whether the individual companies will notify their own patients and clients about the breach remains uncertain.
Maileva is not unfamiliar with cyber threats. The parent company, La Poste, experienced a severe disruption back in December 2025 due to another major cyberattack, which temporarily incapacitated their online banking and service platforms, affecting millions of customers. The disruption impacted various services including La Banque Postale, as well as the main La Poste website and mobile app.
The cyberattack on La Poste was claimed by a pro-Russian hacking group known as Noname057, adding a layer of geopolitical complexity to the challenges France faces with its cybersecurity. In recent years, France has been subjected to several high-profile cyberattacks, with data breaches at Almerys and Viamedis in 2024 exposing millions, and earlier attacks affecting financial institutions and government services.
The increase in cyberattacks correlates with France's prominent economic position and its political stance regarding the ongoing conflict in Ukraine. In fact, data released by CNIL shows a staggering rise in reported data breaches, with over 5,600 incidents noted in 2024 alone — a 20% uptick from the previous year.
The Maileva incident underscores a critical gap in awareness regarding the risks associated with third-party service providers. Many individuals may not realise their data is being processed by companies they have no direct relationship with, raising questions about accountability and consumer protection in the digital age. As cybersecurity threats continue to evolve, it has never been more vital for companies and individuals alike to stay informed about their data privacy and security measures.
Source: securityaffairs.com
