A cyberattack on La Poste subsidiary Maileva exposed the names and postal addresses of 22 million people, including patients and tenants.Maileva, a subsidiary of the La Poste group, was hit in mid-September in one of the biggest cyberattacks France has seen. La Poste confirmed it to AFP..The stolen data includes first names, last names and postal addresses of 22 million people, which are “recipients of Maileva’s client companies.” The company confirms bank details weren’t compromiseda. The specialized sites FrenchBreaches and Cyberattaque.org had flagged the breach first.According to Le Monde, Maileva sends documents on behalf of companies, including payslips, registered letters, invoices and shareholder meeting notices. It is part of Docaposte, a subsidiary of La Poste, and says it serves more than 70,000 users. In 2024, it sent 180 million documents. However, the 22 million people affected by the breach are not Maileva’s customers. They are the people who received documents sent through its platform.This is important because most of these people had never heard of Maileva and had no direct relationship with the company. According to Cyberattaque.org, the affected organizations include social housing providers such as Flandre Opale Habitat and Altéal, as well as medical laboratories belonging to the Inovie group, including AXBIO, BioMedilab and Biofusion. Patients of Foch Hospital in Suresnes were also affected through one of its subcontractors.That subcontractor is Kiwee.care, which handles friendly debt collection and medical billing, and which prints and mails through Maileva. A hacker reportedly read the content of some payment reminders. Those letters carried invoice numbers, treatment dates and amounts owed. Other Kiwee clients in healthcare may be affected as well.Maileva already notified the CNIL, the French data protection authority, and filed a criminal complaint. A judicial investigation is underway ,” it said. “In accordance with regulations, all affected companies have been informed of the incident by Maileva.”It also notified every affected company. Whether those companies will now tell their own patients and tenants is a separate question.La Poste isn’t new to cyberattacks. In December 2025, La Poste confirmed a major cyber incident knocked its information systems offline, disrupting digital banking and online services for millions of customers.On social media, La Poste said the disruption temporarily rendered several platforms inaccessible, including its main website, mobile app, digital identity service, and the Digiposte document storage platform.The attack temporary took down its online services, including La Banque Postale online and the mobile app, laposte.fr, Digiposte, La Poste Digital Identity, and the La Poste application.The pro-Russian hacking group, Noname057, claimed responsibility for the cyberattack.France has faced several major cyberattacks in recent years. In 2024, breaches at Almerys and Viamedis exposed the data of more than 33 million people, while an attack on France Travail affected another 36.8 million. In February, a hacker gained access to data from 1.2 million French bank accounts using stolen credentials belonging to a government official, according to the French Economy Ministry. In June, Tchap, the encrypted messaging platform developed by the French government for its civil servants and made mandatory last year, was breached.This summer, attacks targeting the tax authorities compromised data linked to nearly 700,000 people. Last week, Crédit Mutuel Arkéa also revealed that a cyberattack had cost the company around €100 million.France remains an attractive target because of its economic importance and its political position on the war in Ukraine. The scale of the problem is growing: the French data protection authority (CNIL) recorded more than 5,600 data breaches in 2024, a 20% increase compared with the previous year. The Maileva incident is another reminder that personal data can be exposed through third-party providers that people may not even know they are using.Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, La Poste)