Maileva has confirmed that names and postal addresses belonging to 22 million people were stolen in a cyberattack on the business-mailing service. The new development is a written confirmation obtained by Cyberattaque.org and published on November 13, not a new attack this weekend. A separate notice from Hôpital Foch shows why the consequences can extend beyond an address: some payment reminders could have exposed real invoice details.
The recipient did not need a Maileva account
Maileva is part of Docaposte, the La Poste group’s digital-services business. Its official service description explains the intermediary role: organizations submit correspondence, and the service handles printing and dispatch. A person receiving a hospital reminder or a landlord’s letter can therefore have information processed by Maileva without choosing the provider or creating an account there.
In its response to Cyberattaque.org, Maileva confirmed the theft of first names, surnames and postal addresses for 22 million people, with several thousand client organizations affected. That is a count of people whose identification data was stolen. It is not a claim that 22 million accounts were taken over or that the complete contents of everyone’s correspondence were downloaded.
The distinction matters when reading a notification. The platform-wide identification-data tally and an individual organization’s description of its affected documents answer different questions. The sender’s notice is the relevant place to establish what an exposed mailing actually contained.
A hospital reminder carried a second layer of information
Hôpital Foch’s own notice describes a two-step outsourcing chain: it uses Kiwee for payment reminders, and Kiwee has Maileva print and post them. The hospital says an intruder entered Maileva’s systems in September; it learned on October 28 that reminder contents could have been consulted.
For reminders received between September 9 and 23, the affected information included names, addresses, invoice numbers, dates of care and amounts due. The documents did not identify the treatment or contain patients’ banking details, according to Foch. They could nevertheless reveal that a person had received care at that hospital. This is the hospital’s specific subset, not the data scope established for all 22 million recipients.
The notice turns an abstract address leak into a recognizable trust problem. A payment request can repeat a genuine invoice number and amount while directing the money somewhere else. Matching details can make a message convincing; they do not authenticate its sender or the destination account. The hospital warns about possible impersonation by email, text, post or telephone. It does not report that such a fraud has already succeeded using these records.
Verify the payment route, not just the amount
Foch directs patients to its established payment channels and says that neither it nor Kiwee will ask for passwords, codes or banking details by email, text or telephone. If an unexpected reminder changes how or where to pay, open the hospital’s known website or contact its billing service through details obtained independently. Do the same with the organization named on another affected letter; a familiar logo and a correct address cannot settle the question.
If you are trying to establish whether your correspondence was involved, look for the sender’s official incident notice and contact that organization. The hospital’s September mailing window cannot be applied to every Maileva customer. For a comparison of a different disclosure and its narrower data categories, see what BrickLink confirmed about member-data access.
The useful question after this confirmation is not simply whether a leaked record held a password. It is which real-world relationship the record could help someone imitate, and how to verify the next request through a channel the requester does not control.
References
- Cyberattaque.org. Maileva’s written confirmation of identification-data theft. Original investigation and company response, November 13, 2026; accessed November 15, 2026.
- Hôpital Foch. Maileva–Kiwee data-incident notice. November 6, 2026; accessed November 15, 2026.
- Docaposte. Maileva digital-mail service. Service description; accessed November 15, 2026.
