ENGIE discloses breach of French customer data via a partner marketing tool
ENGIE (France) customer data in a partner prospecting tool
French energy giant ENGIE confirmed that attackers stole customer data after spotting unusual data access in a tool partners use for customer prospecting and marketing energy offers. ENGIE says it cut off the attackers' access, its internal IT systems were not compromised, and the incident is limited to customers in France. Notification letters say the stolen data includes first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE) number, customer ID and contract number. ENGIE says no banking data is affected. It hasn't said how many customers are affected, and no group has claimed the attack.
Why this severity: Customer contact and contract data stolen, no banking data; count undisclosed
- Started
- Oct 27, 2026
Affected
- ENGIE energy customers in France whose data was in a partner prospecting and marketing tool
Fixed in
No fixed release yet
Timeline1
News & write-ups1
Posts1
Energy giant ENGIE discloses data breach affecting customers t.co/pwqGrZpMIY t.co/pwqGrZpMIY
Notes & caveats
ENGIE has notified authorities and every affected customer individually. A year earlier, Scattered LAPSUS$ Hunters leaked records they claimed came from a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America; that is a separate incident.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
