France’s national postal operator La Poste Groupe has confirmed that it was hit by a denial-of-service cyberattack beginning on December 22, 2025, causing widespread disruption to its online services. The company said the attack made multiple digital platforms inaccessible but stated that there was no impact on customer data.
In an initial status update published on December 22, La Poste Groupe said the incident affected access to online services across its ecosystem. While home delivery operations were disrupted, the company reported that collection services at post offices continued to operate. For its banking subsidiary, La Banque Postale, the group said online payments remained available using SMS-based authentication, card payments at point-of-sale terminals continued to function, and cash withdrawals were still possible at ATMs.
On December 23, the company reported partial improvement. Online postal services had resumed but remained unstable, while online banking services were accessible again, though some transactions experienced delays. La Poste Groupe also noted reduced accessibility at some call centers as it worked to restore systems.
By December 24, the company described the attack as unprecedented in scale and power, adding that its intensity was fluctuating and gradually decreasing. Access to laposte.fr had improved, but instability persisted, particularly for parcel tracking services. La Poste Groupe said that parcel and letter delivery operations were continuing as normal, that La Banque Postale’s online banking services were operating normally again, and that call centers were fully accessible.
Third-party reporting indicated that the disruption affected a range of customer-facing digital services, including Colissimo parcel services and Digiposte, La Poste’s secure digital document and mailbox platform. Some reports also referenced temporary impacts on La Poste Mobile. These services play a role in authentication and trusted digital interactions, particularly for banking access, transaction confirmation via SMS, and secure document delivery.
La Poste Groupe consistently stated throughout the incident that there was no breach of customer data and that the event was limited to service availability. The company did not attribute the attack to a specific actor but framed it as a denial-of-service incident rather than a data compromise.
The disruption highlights the dependency of public service ecosystems on digital platforms that support identity-adjacent functions, including authentication, transaction validation, and secure digital communications. It also underscores the operational impact that large-scale availability attacks can have on organizations that provide essential postal, financial, and digital trust services.
Sources: La Poste Groupe, Euronews, 01net, BleepingComputer
—
By the ID Tech Editorial Team
