---
title: "Data breach at Maileva (Docaposte, groupe La Poste)"
description: "Maileva, the online mail-sending service of Docaposte, suffered an intrusion into its production system. According to a data breach notice dated 5 October 2026, an external actor exploited an application flaw, with first suspicious activity on 9 September 2026. The attack was detected on 16 and 17 S"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-09-maileva-docaposte-groupe-la-poste
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-09
dateModified: 2026-10-09
---
# Maileva (Docaposte, groupe La Poste)

Data breach — High

Maileva, the online mail-sending service of Docaposte, suffered an intrusion into its production system. According to a data breach notice dated 5 October 2026, an external actor exploited an application flaw, with first suspicious activity on 9 September 2026. The attack was detected on 16 and 17 September, services were shut down as a precaution on 23 September, and progressive restoration began on 28 September. The mail-tracking database that was accessed holds 39 million mail references, which corresponds to about 22 million people once duplicates are removed. It covers 2026 shipments and, depending on the contracts, up to ten years of history.

These data let a malicious third party learn the names, postal addresses and email addresses of the people concerned and identify the business customers using Maileva, which can be used to craft credible fraudulent mail or messages.

| Fact | Value |
| --- | --- |
| Disclosed on | October 9, 2026 |
| Incident dated | September 9, 2026 |
| Accounts affected | 22M |
| Sector | Digital services |
| Country | France |
| Cause | Undisclosed |
| Severity | High |
| Status | Confirmed |

## Exposed data

- Full name
- Postal address
- Email address
- Customer ID
- Employment data
- Other personal data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Maileva](https://frenchbreaches.com/alertes/maileva-mufora09gh9so92vdk) — FrenchBreaches
- [Cyberattaque : les données de 22 millions de personnes exposées chez un service du groupe La Poste](https://frenchbreaches.com/blog/cyberattaque-les-donnees-de-22-millions-de-personnes-exposees-chez-un-service-du-groupe-la-poste) — Blog FrenchBreaches
- [Maileva : cyberattaque contre sa plateforme d'envoi de courriers](https://fuitesinfos.fr/article/2026-10-09-maileva) — Fuites Infos
- [Maileva (La Poste) : la brèche en clair, et ce qu'une PME doit vérifier dans la foulée](https://www.itsystemes.fr/articles/maileva-la-poste-intrusion-pme-verifier) — IT Systèmes

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-09-maileva-docaposte-groupe-la-poste
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees