La Poste said on 14 November that its subsidiary Maileva suffered a cyberattack in mid-September that led to the theft of contact details concerning 22 million people. The immediate test is whether disclosure now matches the scale: people need specific information about the data involved and how they will be contacted.
Maileva provides services for sending and managing business mail, including electronic registered letters and administrative correspondence. La Poste told AFP that Maileva had notified France’s data-protection authority, the CNIL, and filed a complaint. A judicial investigation is under way.
Those steps matter, but they do not answer the practical questions raised by an incident of this size. The material supplied does not identify which contact-data fields were taken. It also does not say whether passwords, banking information or mail contents were involved, or when and through what channel affected people will receive notice.
It would be wrong to assign a specific personal risk to every one of the 22 million people cited, or to speculate about how the intrusion happened. But the number announced by La Poste creates a clear obligation for meaningful follow-up. CNIL notification, a complaint and an investigation may establish responsibility; they do not remove the need for Maileva and La Poste to explain promptly what was taken and how those affected will be informed.
Sources
- Le Figaro Actualités · Source date: 2026-11-14
- BFMTV Actualités · Source date: 2026-11-14
- franceinfo Tous titres · Source date: 2026-11-14
Independent editorial content. WUA is not affiliated with any political party. 2026-11-14