Good week for file resellers. Docaposte confirms the theft of the names and postal addresses of 22 million people from its Maileva brand. The ChimeraZ hacker fuels the week's data leaks with the basis of a crypto platform and that of the SGS technical control centers. However, a circulating address is the first link in the sequestration of crypto holders, an area where France holds the sad world record.
The key points of this article:
Maileva, a Docaposte brand, acknowledges in writing the theft of identities and addresses affecting one in three French people.
On Lithos, a DEX of the Plasma blockchain, the seller announces 173,146 wallets linked to names and IPs.
The figures put forward for SGS (22.7 million people) have not received any confirmation from the group.
Crossed with an old exchange leak, a simple postal address is enough for crypto kidnapping teams.
Maileva data leak, one in three French people and bonus letters
The story begins on September 23. Maileva, the Docaposte service which sends mail for thousands of companies, cuts everything after spotting suspicious activity. The services then remain stopped for six days and a complaint is filed.
Then, nothing for weeks. It is the customers who warn their users one by one: the Foch Hospital, the laboratories of the Inovie group, the social landlords Flandre Opale Habitat and Altéal.
Maileva finally releases a figure on November 13. In a written response to Cyberattack.org, the company acknowledges that “22 million people are affected by the theft of their identification data”, i.e. first name, last name and postal address. The site also mentions around 39 million references to letters in internal documents.
The Maileva file does not say who owns bitcoin. But crossed with an old exchange leak, hardware wallet or tax software (Waltio in January), it gives the doorbell to ring. The Ministry of the Interior recorded 90 cases of kidnapping, sequestration or extortion linked to cryptos between January 1 and mid-August 2026, according to figures sent to Cointelegraph.
The support also makes the case worse. Maileva ships paper, so scammers now know who is receiving letters from which sender. Ledger customers have already received fake booby-trapped devices in the mail after the 2020 leak: a credible envelope does more damage than a questionable email.
Lithos and SGS, ChimeraZ resolves data leaks on the chain
A pseudonym is popping up everywhere this week. On November 8, ChimeraZ put up for sale 96 GB allocated to the French activities of SGS (Sécuritest, Auto Sécurité, Vérif’Autos). It thus claims 259 million lines, 22.7 million people and 40.9 million unique license plates. The samples consulted by Cyberattack.org do contain vehicle registrations and serial numbers, but SGS has not confirmed anything.
The same seller is tackling territory that you know better on November 10. Its 411 MB file would come from Lithos, a DEX (decentralized exchange platform) of the Plasma blockchain. FrenchBreaches noted in the announcement 173,146 wallet addresses, 134,325 usernames, 112,436 names and 50,239 IP addresses, including 2,147 registrations located in France.
On the other hand, the published sample contains neither private key nor recovery phrase, and Lithos has not reacted. A wallet address attached to a name and an IP, however, removes pseudonymity: the entire onchain history of the wallet becomes readable, including balance, for those who purchase the database.
Data leaks of the week, the rest of the hunt
Ten days earlier, Crédit Mutuel Arkéa had seen more than 100 million euros leave its accounts to end up converted into cryptos. And the list has been growing every day.
ARTE, 643,760 student and teacher files published by a pirate on November 11
Macif Avantages, customer data exposed via its voucher provider Qwertys
Monceau Fleurs, Au Nom de la Rose, Happy and Cœur de Fleurs, customers of the Emova group affected on November 11
HomeMaison, 1.6 million email addresses claimed on November 12
Location-etudiant.fr, 825,894 lines for sale
La Rez in Vandoeuvre-lès-Nancy, tenant files distributed with their IBAN
Armentières hospital center, 261,948 recordings from 2024 put back into circulation on November 13
Data leaks, sorting the truth and keeping good crypto reflexes
The figure of 9 million patients from 1001RDV circulated faster than the others. The publisher of this medical appointment platform, Softwarenet, claims that only its WordPress showcase was affected and denies any exfiltration. No independent verification has been published to date, so be careful with spinning captures.
For crypto holders, the action to take can be summed up in a few words. No company will ask you for your recovery phrase, either by mail or by phone. Never publicly link a wallet address to your name, and keep the amount in your wallet to yourself, at the office or at family dinner.
