ENGIE confirms French customer data theft via compromised third-party partner marketing platform; internal IT unaffected

Linha do tempo

1. securityaffairs.com ↗ · pub. 29/10/2026 05:53 · coletado 29/10 08:00

   ENGIE discloses breach of partner sales tool exposing French customer contact and energy contract data

   ler a análise desta fonte ocultar

   ENGIE, the French multinational energy company, warned customers in France that attackers gained unauthorized access to personal data held in a sales tool used by some business partners to market its electricity and natural gas offers. The company says its internal IT systems were not compromised and banking information was not affected. It has blocked the attackers' access, notified the relevant authorities and contacted affected customers. ENGIE has not named the partner or platform, the number of affected customers, or when the intrusion began or was discovered. No threat actor or ransomware group has claimed responsibility.

   Technical Details

   • Exposed data: names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers.
   • Electricity customers also had their delivery point identifier (PDL) exposed; gas customers had their metering and estimation point (PCE).
   • The accuracy of the data makes impersonation and social engineering scams plausible, including attempts to obtain further data or induce payments.
   • Initial access vector and attribution are not disclosed.

   Remediation

   • Customers should verify unexpected requests through ENGIE's official website or app, not through links in emails.
   • Treat unexpected calls and messages with caution, even when the sender knows personal or contract details; a contract number does not prove a caller is legitimate.
   • Never share SMS verification codes, passwords or banking details with anyone who makes unsolicited contact, and verify requests using independently obtained official contact details.
2. infosecurity-magazine.com ↗ · pub. 28/10/2026 11:05 · coletado 28/10 16:01

   Engie notifies customers of personal data exposure after compromise of third-party marketing platform

   ler a análise desta fonte ocultar

   Engie, the French energy multinational, has notified an undisclosed number of customers that their personal data may have been exposed in a supply chain breach. Engie says its own IT systems were not compromised. The incident involved a third-party marketing tool used by partners for customer prospecting and energy offer marketing in France. Engie detected unusual data access activity, disabled the relevant access, launched an investigation and considers the incident contained. No extortion group has claimed responsibility at the time of writing.

   Technical Details

   • Exposed data: full name, postal and email address, phone number, energy supply unique IDs (PCE/PDL), customer ID and contract number. Engie confirmed no banking data was involved.
   • Vector: unauthorized access to a partner-facing marketing and prospecting platform, not Engie's internal infrastructure.
   • Engie warned that the data could be used for impersonation, social engineering, phishing or attempted fraudulent payments.
   • Context: in October 2025, Scattered LAPSUS$ Hunters listed Engie on its leak site after the Salesforce campaign (over 100 instances compromised, over one billion records claimed). The victim was Engie Resources, the US retail energy unit, with 3GB of data claimed. The article draws no link between that event and the current breach.
   • Insurer Resilience reports that no UK or European energy and utilities clients have reported ransomware since July 2025. European claims with a recorded cost involved only fraud or exposed customer data.

   Remediation

   • Affected customers should watch for phishing emails and impersonation attempts that appear to come from trusted organizations.
   • Engie disabled the affected access and put enhanced monitoring in place.
3. bleepingcomputer.com ↗ · pub. 27/10/2026 06:25 · coletado 27/10 07:00 primeiro registro

   ENGIE discloses breach of partner marketing platform exposing French customer contact and contract data

   ler a análise desta fonte ocultar

   French energy giant ENGIE confirmed that attackers stole customer data after gaining access to a marketing tool used by business partners for customer prospecting and energy offer marketing. The company says its internal IT systems were not compromised and that it cut off the attackers' access to the platform. The incident is limited to customers in France; the number of affected customers was not disclosed. ENGIE has notified authorities and individually informed the affected customers. No threat group has been attributed and no ransomware or extortion gang has claimed the breach as of publication.

   Technical Details

   • Initial detection was "unusual data access activity" within a partner-facing prospecting and marketing tool. The article does not describe the intrusion method.
   • According to breach notification letters, the exposed data includes first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.
   • ENGIE states that no banking data was affected.
   • Context: a year earlier, Scattered LAPSUS$ Hunters leaked records they claimed to have stolen from a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America. The article does not link the two incidents.

   Remediation

   • ENGIE reminded affected customers to take precautions against potential fraud and phishing attempts that abuse the exposed contact and contract details.
   • Access of the attackers to the compromised platform was revoked.