A name and a home address are all a convincing scam needs
La Poste confirmed to Agence France-Presse on Saturday 14 November that the Maileva data breach, a mid-September cyberattack on the business-mail platform, exposed the first name, surname and postal address of 22 million people, Le Temps reported. La Poste said bank details were not affected, and it has disclosed no other categories of stolen data.
The data sounds modest next to a password or a bank card. It is not. A real name matched to a real home address is what makes a phishing letter, a fake delivery notice or an impersonation call convincing. Maileva sends payslips, registered letters, invoices and meeting notices for its client companies, so many of the addresses belong to people who expect mail from a company or organisation they deal with. That is the risk here, and it is why a breach of names and addresses still matters.
Think about what a scammer can do with exactly this set of facts. A letter that quotes your real name, your real address and the name of a company that actually sends you mail is hard to dismiss on sight. The same goes for a delivery notice that arrives with the right name and the right street, or a caller who knows where you live before asking for anything else. None of that needs a password, only the victim’s belief that the message is genuine. The stolen data does not open a bank account by itself. What it opens is the door to the message that tries to.
What happened in the Maileva data breach
Maileva is a subsidiary of Docaposte, itself part of the La Poste group. It claims more than 70,000 users and sent 180 million documents in 2024, Le Temps reported. Its clients include private companies, public institutions, health organisations and government administrations, Paktechstan reported.
Maileva detected unauthorised access attempts on the morning of 23 September 2026 and interrupted its services the same day, Paktechstan reported. The accounts were apparently being used to send mail without the owners’ consent. Services resumed on 29 September, six days later. All the client companies concerned have been informed of the incident by Maileva, according to the La Poste statement sent to AFP.
The detail about the accounts matters, because it is how the intrusion showed itself. The access attempts were on client accounts, and the accounts were apparently being used to send mail without the owners’ consent. Maileva stopped its services while it dealt with that, and the platform was back up within a week. A separate internal Docaposte document, cited by FrenchBreaches, says the attackers exploited an application flaw in Maileva’s production system, and puts the start of suspicious activity at 9 September. No official communication has confirmed that document, and La Poste has not said who the attackers were.
How the story surfaced
FrenchBreaches and cyberattaque.org were the specialist sites that first reported the incident, Le Temps reported. Cyberattaque.org revealed the attack on 24 September, after obtaining a client communication. At that point no massive data leak had been announced. The first confirmation of a data leak came on 9 October, when an occupational health service in Cornouaille said an unauthorised third party had accessed a Maileva mail-tracking database. Cyberattaque.org published the 22 million figure on 13 November, with Maileva’s written confirmation, and La Poste confirmed the scale to AFP the next day. The AFP wire was carried by Le Temps, France 24, Malay Mail, Les Echos and Le Parisien. Maileva has notified France’s data-protection regulator, the CNIL, and filed a formal complaint. A judicial investigation is under way.
The incident was first reported in September, a data leak was confirmed in October, and only in November did the company confirm the 22 million figure at full scale. The 52-day gap is the story of this breach as much as the number itself.
Fifty-two days from shutdown to confirmation
The gap between the shutdown and public confirmation is our own calculation. Maileva shut its services down on the morning of 23 September after detecting unauthorised access attempts. La Poste confirmed to AFP on 14 November that 22 million people were affected. That is 52 days, and for those 52 days the people whose names and addresses had been taken had no public confirmation of the scale. For comparison, Fullerton Health’s breach count took 14 days to surface earlier this month.
The 22 million figure already accounts for duplicates. Internal documents cited by cyberattaque.org put the compromised database at roughly 39 million mail references, because one person can receive letters from several different organisations. That 39 million figure is claimed, not confirmed by La Poste. There is no evidence so far that the stolen files have been publicly released or sold, EuropeSays reported, which is not proof they have not been.
Where Maileva ranks in France
The table below puts Maileva next to France’s other large breaches of the last three years. All four figures are confirmed.
| Breach | Year | People / accounts affected | Status |
|---|---|---|---|
| France Travail | 2024 | 36.8 million | Confirmed |
| Viamedis and Almerys | 2024 | More than 33 million | Confirmed |
| Maileva / La Poste | 2026 | 22 million | Confirmed |
| ANTS / France Titres | 2026 | 11.7 million accounts | Confirmed |
On confirmed figures, Maileva is the third-largest breach in this set, behind France Travail and Viamedis and Almerys, both from 2024. France Travail was first reported as 43 million people potentially affected; the CNIL’s January 2026 decision records 36,820,828 people whose data was exfiltrated, brief.news reported. Viamedis and Almerys affected more than 33 million people, BleepingComputer reported. The ANTS figure started as a criminal claim of up to 19 million records in April 2026, The Register reported. ANTS confirmed on 24 April that 11.7 million accounts were affected, BleepingComputer reported. FrenchBreaches and cyberattaque.org called the Maileva leak one of the largest ever acknowledged in France. That is their characterisation, not a measured ranking.
Two other French incidents sit in the background, and both are separate from this one. La Poste itself was hit by a cyberattack claimed by pro-Russian hackers a few days before Christmas 2025, Le Temps reported. Crédit Mutuel Arkéa said in the week of 9 November 2026 that hackers stole around 100 million euros of the bank’s own money through fraudulent transactions, Le Temps reported.
What the stolen data can and cannot do
The stolen data is first names, surnames and postal addresses, and nothing else has been disclosed about the 22 million recipients. That limits what an attacker can do directly. La Poste said no bank details were taken, so this data alone does not open a bank account or move money. No passwords were disclosed either, so it does not log anyone into anything.
Reporting based on internal Docaposte documents adds one caveat: the compromised data also included business-client details such as email addresses, billing details and IBANs. That is a different set of records from the 22 million recipients’ names and addresses, and La Poste has not confirmed it.
What it does is make the next message believable. A fake delivery notice with the right name and the right street is harder to spot than a generic one. A letter claiming to come from a company that really does send you mail, quoting your real address, reads like the real thing. An impersonation caller who already knows where you live starts the conversation a step ahead. The defence is not a password change. It is treating every message that quotes your details as unproven until you check it through a channel you trust.
There is no evidence so far that the stolen files have been publicly released or sold, which is not proof they have not been. Whether the data surfaces for sale, in a leak, or in targeted scam campaigns is the open question.
What should I do if my name and address were in the Maileva breach?
Treat any letter, call or message that quotes your name and home address as unproven until you check it another way. La Poste says no bank details were taken, so watch for phishing letters, fake delivery notices and impersonation calls. No lookup tool has been announced, so assume your details may be in circulation.
- Treat unexpected letters quoting your address as unproven and verify the sender through a separate channel.
- Call your bank or employer on a number you already trust before acting on any payment request.
- Refuse delivery or customs fees demanded by text, email or a phone call, and check the carrier directly.
- Watch for mail or messages in your name that you did not expect, and report suspected fraud to your bank.
- Tell the company named in a suspicious message about it, using a contact you already trust.
- Ask the company that sends your payslips or invoices how it will notify affected customers.
What is confirmed, and what is not
Confirmed: the Maileva data breach began in mid-September 2026, and La Poste confirmed to AFP on 14 November that the names and postal addresses of 22 million people were exposed. The figure already accounts for duplicates. La Poste said bank details were not affected. Maileva notified the CNIL and filed a formal complaint, and a judicial investigation is under way. All the client companies concerned have been informed.
Not confirmed: the identity or motive of the attackers, and whether the stolen data has been sold or leaked. La Poste has not disclosed the attack method or the systems compromised in its public statements; an internal document cited by FrenchBreaches describes an application flaw, but no official communication has confirmed it. The roughly 39 million mail references figure comes from cyberattaque.org citing internal Docaposte documents and is not confirmed by La Poste. Maileva does not contact individuals directly; the client organisations are responsible for informing the people concerned, and no count of individuals notified has been confirmed. No country breakdown has been given.
What to watch next
First, whether the CNIL or the judicial investigation publishes findings on how the attackers got in, since La Poste has disclosed nothing about the method so far. Second, whether the stolen names and addresses surface for sale or in a leak, since no evidence of that exists so far. Third, whether Maileva or its client companies notify individuals directly, beyond the companies already informed, since no individual notifications have been confirmed. And fourth, whether the 39 million mail references figure is confirmed or corrected, since it is the only public estimate of the raw database size.
