The names and addresses of 22 million people were stolen from Maileva, a La Poste Group company. Combined with tax data or customer files from cryptocurrency companies that have already been hacked, this information could make it easier to target cryptocurrency holders, including at their homes.
Addresses of 22 million people stolen
The first and last names and postal addresses of 22 million people were stolen from Maileva, a Docaposte brand, the digital subsidiary of La Poste Group. This service provider prints and sends mail for thousands of companies and organizations, particularly in the healthcare, social housing and public services sectors.
The files concerned contain around 39 million mail references, corresponding to 22 million people after deduplication. According to the affected organizations, senders’ email addresses and file names were also exposed.
The billing tool also reportedly made the IBANs and invoice amounts of client companies accessible, according to an internal document cited by FrenchBreaches. Management nevertheless says that individuals’ bank details were not affected.
In some cases, other information was accessible. Foch Hospital said that reminders containing invoice numbers, dates of medical care and amounts owed could have been viewed, but not patients’ bank details. A social housing provider reported that some letters went back as far as 10 years.
Maileva suspended its services on September 23, then restored them 6 days later. The scale of the theft was not confirmed until nearly 2 months after the incident.
Cross-referencing leaks can make targeting easier
For cryptocurrency holders, the risk comes from combining several stolen databases. An address can make it possible to locate a person, while other files may provide indications of their income or suggest that they own cryptocurrency.
This summer, intrusions into the DGFiP’s systems made it possible to view and extract information about 678000 individuals and professionals, including their reference taxable income. Cadastral data, including property addresses and areas, was also viewed.
A leak at a cryptocurrency company can therefore reveal a business relationship, tax data can give an indication of income, and a postal file can specify a home address. Such cross-referencing can help select targets, without revealing the cryptocurrency assets they hold. So far, no cross-referencing involving Maileva’s files has been established.
From postal scams to the risk of physical assault
The data leak at Ledger illustrates this exposure. In 2020, the detailed contact information of around 272000 customers of the hardware wallet manufacturer was disclosed. Scammers later sent fake devices to users to obtain their recovery phrase, a series of words that gives access to their funds.
The risk is not limited to scams: assaults targeting people associated with cryptocurrency are a reminder of the importance of protecting personal contact information. However, no link has been established between the Maileva leak and a kidnapping.
If you receive suspicious mail, it is best to contact the organization using its usual contact details. Never share your recovery phrase with anyone or enter it on a website named in a letter or message, even if it presents the request as an urgent security procedure.
Sources: Le Figaro, cyberattaque.org
