When Marie‑Claire Dupont opened a letter from her local housing office in early October, she expected a routine reminder about her rent. Instead, the envelope bore a stark warning: her name, address, and the names of thousands of neighbors had been lifted from a database and were now for sale on a hidden corner of the internet. The notice came from Maileva, a subsidiary of France’s state‑run postal service La Poste, which on 14 November 2026 announced that a cyberattack in late September 2023 had exposed the personal details of 22 million individuals.
Maileva, though less known to the public than its parent La Poste, processes bulk mail for a swath of French institutions. From social‑housing agencies that dispatch rent notices to laboratories that send test results, the company’s platforms sit at the intersection of public administration and private correspondence. Its clientele includes thousands of businesses, each entrusting the firm with the identifiers of their constituents.
The breach began on 30 September 2023, when attackers penetrated Maileva’s digital infrastructure. While the precise method of entry remains under investigation, the result was a wholesale extraction of identification data: first names, last names, and postal addresses. In a statement released three years later, Maileva confirmed that the theft “affected 22 million people: first name, last name, postal address.”
In the wake of the intrusion, Maileva notified French regulatory bodies and lodged a formal complaint.
France’s population hovers around 67 million. By the agency’s own accounting, the 22 million compromised records represent roughly one‑third of all French residents. The breach therefore did not merely affect a niche of high‑profile officials; it reached deep into the everyday fabric of French society, touching citizens from bustling Parisian arrondissements to remote Alpine villages.
The fallout extended beyond individual citizens. Maileva’s statement emphasized that “several thousand Maileva client companies” were also impacted. Among them were social‑housing organizations, laboratories, and medical institutions—entities that already issued breach notifications of their own. The loss of client data meant that these organizations now faced the prospect of their own customers’ information being exposed, compounding the breach’s ripple effect.
In the wake of the intrusion, Maileva notified French regulatory bodies and lodged a formal complaint. An investigation is underway, though details of the probe have not been disclosed. The company’s neutral stance—reflected in its measured public communications—underscores a broader tension in France: the need to protect citizens’ data while preserving the continuity of essential public services.
Maileva’s disclosure arrived against a backdrop of alarming statements from French law‑enforcement officials. On 1 October 2023, General Petiot of the National Gendarmerie warned that data belonging to approximately 80 percent of French citizens was already being sold on the dark web, a consequence of a spate of recent cyberattacks. This stark figure suggests that the Maileva breach is part of a larger, systemic leakage of personal information across the country.
The Maileva episode is not an isolated incident. Over the past few years, French governmental bodies—including the tax authorities, the Ministry of the Interior, the Ministry of Sports, the Ministry of Education, and databases that track government‑owned weapons—have all fallen victim to cyber intrusions. Each breach has chipped away at public confidence, highlighting vulnerabilities in the nation’s digital defenses.
For the average French person, the breach translates into a heightened risk of phishing scams, identity theft, and unsolicited solicitations. With a name and address now publicly accessible, malicious actors can craft convincing correspondence that appears to come from trusted institutions. The breach also forces businesses that rely on Maileva’s services to reassess their own data‑security protocols, potentially prompting a shift toward more decentralized or encrypted communication channels.
As of the announcement on 14 November 2026, the investigation into the September 2023 attack remains open. Maileva’s acknowledgment of the breach, coupled with the broader warning from General Petiot, paints a picture of a nation grappling with the realities of a data‑driven age. The incident underscores the urgency for France to bolster its cyber‑defenses, enforce stricter data‑handling standards, and provide clear pathways for victims to protect themselves.
The story of Maileva is a reminder that in an interconnected world, a single breach can reverberate across millions of lives, reshaping the relationship between citizens, institutions, and the digital infrastructure that binds them together.