Maileva hack, La Poste's online mail service, exposes laboratory patients' data

On September 23, 2026, at 7 a.m., Maileva shuts everything down. The brand belongs to Docaposte, a subsidiary of the La Poste group, and lets companies and organizations send letters and registered mail from a computer. It had just detected attempts at unauthorized access to customer accounts. According to Docaposte, the cybercriminal was trying to send illegitimate mail. On September 29, Maileva's services were "fully operational again," the group said. At that point, no one was talking about a data leak.

Five weeks later, the picture has changed. On November 2, the medical testing laboratory group Inovie published a notice: patients of several of its laboratories are affected by a data leak at Maileva, its mail-sending provider. On November 3, Flandre Opale Habitat, a social housing landlord in the Dunkirk area, in turn warned its tenants. The specialist sites Fuites Infos and Cyberattaque.org logged these notices on November 5.

What could the intruder see?

One customer was among the first to give details. In a notice dated October 9, an occupational health service in Quimper writes that Maileva's information system "was the target of a cyberattack." It allowed an unauthorized third party to access a mail-tracking database. For senders: last name, first name, user ID and email address. For recipients: last name, first name, title and postal address. The names of the files attached to the mailings were also included. The service says it has no evidence that the contents of the documents were viewed or extracted. Maileva found no modification or destruction of data.

The November notices point the same way. Inovie mentions the names, first names and postal addresses of some patients, and says no payment data or passwords are affected. It says nothing, however, about health data or the contents of the letters, and gives no number of people affected. According to Fuites Infos, Flandre Opale Habitat says the incident may have given access to data found in letters sent over the past ten years, such as a customer number or an invoice amount, and that it has notified the CNIL (the French data protection authority). According to Cyberattaque.org, the landlord adds that not all the information concerned is necessarily compromised.

A file name can say a lot

How many people are affected? Neither Maileva nor La Poste has published a figure. The site FrenchBreaches, however, claims, citing a Docaposte document dated October 5, that an application flaw was reportedly exploited and that 22 million distinct people are affected; this figure has not been publicly confirmed. A name and an address may seem like little. But when the sender is a testing laboratory or an occupational health service, it is not trivial. The Quimper service acknowledges this itself: the nature of a letter or the name of a file can indirectly reveal information about a person's health or occupational follow-up.

How to handle fake mail

You don't need a Maileva account to be affected: it is enough to have received a letter from an organization that used this service. The main risk is the credible scam, by mail, email or phone, that cites your laboratory, your landlord or your medical follow-up.

• Never give out bank details, user IDs or passwords in response to an unsolicited request, even if it mentions your file.
• If in doubt, call the organization back at the number on your usual documents, never the one in the message you received.
• Beware of fake notices of IBAN changes and fake invoices: that is precisely what a fake letter with an official look would allow.
• Scam victims can find free help at cybermalveillance.gouv.fr.

For companies that are Maileva customers, the question is broader: which letters passed through the platform, sometimes over ten years as at Flandre Opale Habitat, and should their recipients be notified? More notices may follow. As with the policyholders of Malakoff Humanis, affected through a service provider attacked in August, it is often indirectly that those concerned find out.

Update of November 12, 2026

Two other customers of Maileva, the online mail service of Docaposte (La Poste group), have warned their users. On November 6, Hôpital Foch, in Suresnes, published a notice for patients who received a payment reminder between September 9 and 23, 2026. These letters, which Maileva prints and mails on behalf of the company Kiwee, include the name, first name, postal address, invoice number and amount, and the date of care, according to Fuites Infos. They mention neither the nature of the care nor any bank details. Their contents may have been viewed, but the hospital does not say they were copied or distributed. It reported the incident to the CNIL and does not give the number of patients affected.

On November 9, Altéal, a social housing landlord in Colomiers, near Toulouse, which manages about 14,000 homes in Occitanie, said in turn that the incident at Maileva may have compromised the confidentiality of some of its tenants' personal information. According to Cyberattaque.org, its online alert does not specify the number of tenants affected.

According to the tally by the site Ostraca, updated on November 9, neither Maileva nor La Poste has, to its knowledge, published a statement on this data.