French energy company ENGIE has confirmed that attackers stole customer information after gaining access to a marketing platform used by the company’s business partners. ENGIE said its internal IT systems were not compromised and that the incident affected customers in France.
ENGIE operates in renewable energy, infrastructure and customer energy supply across 30 countries. The company employs more than 90,000 people and reported €71.9 billion in revenue last year.
Attack limited to partner marketing platform
An ENGIE spokesperson told BleepingComputer that the attackers had been blocked from the compromised platform and had not accessed the company’s internal systems.
“ENGIE’s internal IT systems have not been compromised. ENGIE recently became aware of unusual data access activity within tools used by partners as part of customer development activities and marketing of energy offers,” the spokesperson said.
ENGIE did not disclose how many customers were affected, but said the incident was limited to customers in France.
The company has notified the relevant authorities and contacted affected customers about the breach.
“According to research conducted so far, the data involved is limited to customer contact details and specific information related to energy contracts. Banking data is not affected,” ENGIE told BleepingComputer.
“In the interest of transparency, ENGIE has individually notified each customer involved, reminding them of the precautions they should take to protect themselves from potential fraud and phishing attempts.”
Customer contact and contract data exposed
ENGIE has not publicly detailed all of the information stolen. However, a breach notification letter sent to affected customers says attackers accessed their first and last names, mailing addresses, email addresses, phone numbers, point of delivery (PDL) or point of weighing and quotation (PCE), customer IDs and contract numbers.
ENGIE has not attributed the attack to a specific threat group. No ransomware activity or extortion group had claimed responsibility for compromising ENGIE before publication.
Previous claims involving an ENGIE subsidiary
A year ago, the Scattered LAPSUS$ Hunters extortion group leaked records that it later claimed to have stolen. The group was suspected of having breached the Salesforce instance of ENGIE Records, a retail energy supply subsidiary of ENGIE North America.
The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com