ENGIE: partner platform breached, French customer data stolen

ENGIE, the French energy group operating in 30 countries with more than 90,000 employees, has confirmed that attackers stole customer data from a tool used by its business partners to prospect for new customers and sell electricity and gas offers in France. According to the company, its internal IT systems were not compromised and no banking data is involved. The news is reported consistently by BleepingComputer, Infosecurity Magazine and Security Affairs.

What happened

In a statement sent to BleepingComputer and Infosecurity Magazine, ENGIE says it recently identified unusual data access activity within this tool. The measures described by the company:

• the relevant access was disabled as soon as the activity was detected;
• an in-depth technical investigation was launched to establish the circumstances, assess the scope and identify the affected customers;
• enhanced monitoring was put in place;
• the relevant authorities were notified and each affected customer was informed individually, with the precautions to take against fraud and phishing.

According to Infosecurity Magazine, the company now considers the incident contained. The spokesperson told BleepingComputer that it concerns only customers in France, without giving a number.

What data was exposed

The list comes from the notification emails sent to customers: BleepingComputer and Security Affairs quote them directly, while Infosecurity Magazine relies on screenshots posted on X. The three sources agree on:

• first and last name;
• postal address, email address and phone number;
• customer ID and contract number;
• supply point identifier: PDL (Point de livraison, delivery point) for electricity and PCE (Point de comptage et d’estimation, metering and estimation point) for gas.

In the notification quoted by Security Affairs, ENGIE refers to an “act of cyber-malice” that affected a tool used by some partners to market its energy offers.

What is still unknown

• The partner and the platform: they have not been disclosed (Security Affairs). Infosecurity Magazine describes a third-party marketing platform and calls the incident a supply chain breach.
• The access vector: no source says whether a partner’s credentials, a vulnerability in the tool or something else was used; for this reason no specific MITRE ATT&CK techniques can be mapped to the intrusion.
• Timing and numbers: it is not known when the access began, when it was discovered or how many people are affected.
• Attribution: ENGIE has not attributed the attack and, as of the articles’ publication, no ransomware or extortion group had claimed it.

BleepingComputer and Infosecurity Magazine recall an earlier episode: in October 2025 the Scattered LAPSUS$ Hunters extortion group leaked data it claimed to have stolen from a Salesforce instance of the US retail energy subsidiary (Engie Resources), as part of its campaign against more than 100 Salesforce instances; according to Infosecurity Magazine the group claimed 3 GB of data. No source links that case to the current incident.

Why it matters in Europe too

The exposed data does not give access to any system, but it is enough to build highly convincing scams: anyone who knows a customer’s name, address, contract number and supply point code can pose as the supplier, one of its partners or a competitor, and offer plan changes, refunds or bills to settle. ENGIE itself warns that the data could be used to impersonate customers with other organisations or to request payments. As Security Affairs notes, a correct contract number does not prove that a caller is legitimate.

Across Europe, including Italy, electricity and gas contracts are often sold through agencies and business partners working on tools shared with the supplier. For energy companies, which are essential entities under NIS2, supply chain security is one of the mandatory measures; for customers’ personal data, the GDPR requires notifying the supervisory authority within 72 hours and, where the risk is high, informing the people concerned.

Finally, Infosecurity Magazine reports figures from insurer Resilience: since July 2025 no UK or European energy and utilities client has reported ransomware, and European claims with a recorded cost involved only fraud or exposed customer data; in the US, by contrast, ransomware accounts for around 70% of the sector’s incurred losses.

What to do now

If you share customer data with partners, agencies or marketing platforms:

• take an inventory of external access to CRM and sales tools, close inactive accounts and require multi-factor authentication or access through corporate SSO;
• limit each partner’s visibility to its own contacts and to the fields it actually needs: prospecting rarely requires contract numbers or supply point codes;
• set thresholds and alerts for bulk lookups and exports, access from new addresses or countries and at unusual hours: this is the kind of anomaly that allowed ENGIE to spot the access;
• check your supplier contracts for incident notification deadlines and the availability of access logs.

To limit phishing after a breach:

• prepare customer notification texts in advance and point to an official channel for verifying requests;
• move DMARC to reject on the domains you use to write to customers and keep an eye on lookalike domains registered by others;
• remind customers and employees never to share SMS codes, passwords or banking details with anyone who contacts them unexpectedly, and to sign in only through the official website or app.

How ARXDOME can help

ARX Expose shows what an attacker sees of your company from the outside: email configuration (SPF and DMARC), lookalike domains registered by others, often used in the phishing campaigns that follow a breach, and company accounts involved in known breaches. ARX Sentry groups server and firewall events into families such as bursts of login attempts and night-time logins, useful for spotting anomalous use of accounts.

Last updated: 29 October 2026