Maileva (La Poste) confirms theft of the addresses of 22 million mail recipients

On September 23, at 7 a.m., Maileva shut down its services. The online mail-sending service of Docaposte, a subsidiary of La Poste (the French postal service), spoke at the time of unauthorized attempts to access customer accounts in order to send fake letters. Seven weeks later, the story has changed.

In a written response published on November 13 by the website Cyberattaque.org, Maileva itself gives a figure: “22 million people are affected by the theft of their identification data: first name, last name, postal address.” These are the recipients of letters sent by “several thousand client companies.” The company says it has notified the CNIL (the French data protection authority) and filed a complaint, and a judicial investigation is under way. Until now, this figure was based on an internal document and had not been publicly confirmed, as we wrote in our first article on this leak.

From 39 million letters to 22 million people

This document is a Docaposte fact sheet dated October 5, which the site FrenchBreaches revealed on October 9. It gives a different timeline from the first communication. An attacker allegedly exploited a vulnerability in a Maileva application to get into its production system. The first suspicious activity dates back to September 9, and detection to September 16. The mail-tracking database that was hit contains 39 million shipment records. Once duplicates are removed, they correspond to about 22 million distinct people. Depending on the contracts, the history can go back ten years.

For recipients, the sheet lists title, last name, first name and postal address. For client companies, it mentions account names, login credentials, email addresses and the names of the files sent. It also lists billing contacts, invoice amounts and these companies' IBANs (bank account numbers), stored in the OpenCell billing tool. In October, Docaposte was still trying to establish what might have been extracted. Maileva now speaks of theft. The theft of the full content of the letters, however, is not confirmed.

Some clients nonetheless say more. On November 6, the Foch hospital in Suresnes warned its patients that payment reminders sent between September 9 and 23 were affected: invoice number, date of care, amount claimed. These letters went through Kiwee.care, its debt collection provider, which entrusted Maileva with printing and sending some mail. The social housing landlord Flandre Opale Habitat, for its part, mentions customer numbers and invoice amounts.

Who must notify you?

Not Maileva. The company says it has informed all affected organizations, and it is up to them to warn the people concerned. Since October, a few have done so publicly: the Cornouaille occupational health service, the IZILO transport network of Lorient Agglomération, the Inovie group's laboratories, the landlords Flandre Opale Habitat and Altéal, and the Foch hospital. Given several thousand clients, the list is short. No one publishes the number of people actually notified.

A fake reminder becomes very credible

A name and an address already appear in many databases. What changes here is the context. A scammer who knows you received a reminder from your hospital or your landlord can imitate it. Cyberattaque.org sums it up: “The main risk identified by Foch Hospital now concerns payment fraud.”

• Be wary of any unexpected reminder, by mail, text message, email or phone, in the name of a hospital, a landlord, a laboratory, the national health insurance (Assurance maladie) or a supplementary health insurer.
• Pay only through the organization's usual channels, after verifying the request with its official contact details, never those given in the message you received.
• If your company is a Maileva client: IBANs and billing contacts are within the scope described by Docaposte. Have any request to change bank details confirmed by phone with a known contact. If Maileva has notified you of the incident, it is also up to you to warn your recipients.

One question remains open: where did this data go? According to Cyberattaque.org, nothing establishes at this stage that it has been leaked or put up for sale, and Maileva says nothing about the identity of the perpetrators. It will be up to the judicial investigation to establish who got in, and what was taken.