France: La Poste under cyber-attack – 22 million accounts compromised
Maileva, a strategic hub for digital correspondence, has come under attack from cybercriminals
Key points
A devastating large-scale cyberattack has brought France to a standstill in the last few hours. The hackers targeted Maileva, a strategic hub for digital correspondence operated by Docaposte (part of the La Poste group). The toll of the breach is immense: the data of 22 million citizens has fallen into the hands of cybercriminals. Those most affected have been the recipients of mail managed by the portal, a crucial platform used daily not only by private sector giants but also by government agencies across the Alps.
The company has admitted to having suffered a major cyber-attack dating back to mid-September, the full extent of which is only now becoming apparent. The attack “led to the exposure of contact details (first name, surname, postal address) of 22 million people who are recipients of postal services provided by Maileva’s corporate clients”, stated La Poste Group in a press release sent to AFP. “In accordance with the regulations, all affected companies have been informed of the incident,” it added. Maileva “has reported the incident to the National Commission for Information Technology and Civil Liberties (CNIL) and has filed a complaint”.
Hospitals and testing laboratories have also been affected
An investigation has been launched into an ‘attack on an automated data-processing system’ by the cybercrime division of the Paris Public Prosecutor’s Office and has been entrusted to BL2C, a specialist investigative unit. According to Cyberattaque.org, cited by Le Figaro, those affected include social housing providers (such as Flandre Opale Habitat and Altéal), patients of medical laboratories (including Inovie Axbio, BioMedilab and Biofusion, part of the Inovie group) and hospital patients such as those at the Foch Hospital in Suresnes (Hauts-de-Seine), via a subcontractor. In the latter case, a hacker is believed to have gained access to the contents of several payment reminder letters, which also contained invoice numbers, treatment dates and amounts due, whilst clinical data and bank details remained secure. The data breach at Hôpital Foch occurred via a cyberattack targeting the external supplier Kiwee, a company specialising in healthcare debt recovery, to which the hospital had outsourced the sending of payment reminders.
The escalation
This large-scale cyberattack is part of a worrying escalation of cyberattacks that have hit French companies and institutions hard in recent months. Earlier this summer, the Directorate-General for Public Finances (Dgfip) had already fallen victim to a serious breach, described by Le Monde as ‘one of the most sensational and embarrassing data breaches for the State in recent years’. According to the newspaper, following that incident, the French Office for the Fight against Cybercrime (OFAC) investigated two very young hackers, aged 16 and 18, known online as ‘ChatNoir’ and ‘Casquette’.
Banks on high alert
The level of concern remains extremely high in the banking sector too: just last week, Crédit Mutuel Arkéa reported that it had suffered a cyber-attack causing an estimated loss of around 100 million euros. This is a steadily growing trend, confirmed by figures from the French Data Protection Authority (CNIL), which had already recorded over 5,600 breaches by 2024, marking a 20 per cent increase on the previous year.
