ENGIE Confirms Customer Data Stolen in Marketing Platform Breach
Summary
ENGIE confirmed attackers stole French customers’ contact and energy-contract data through a partner marketing platform. The company said its internal systems and customers’ banking data were not affected.
Key points
- ENGIE said attackers accessed a marketing tool used by business partners for customer prospecting and energy-offer marketing.
- The company said the breach was limited to customers in France; the number affected was not disclosed.
- Affected data included names, addresses, email addresses, phone numbers, customer IDs, contract numbers, and energy delivery or metering identifiers.
- ENGIE said its internal IT systems and customer banking data were not affected.
- ENGIE cut off access, notified relevant authorities, and contacted affected customers with precautions against fraud and phishing.
- ENGIE did not identify a threat actor; no ransomware or extortion group had claimed responsibility at publication.
Article Details
- Victim Organization
- ENGIE
- Incident Type
- Customer data breach involving unauthorized access to a marketing platform used by business partners and theft of customer data.
- Disclosure Date
- 2026-10-27
- Data Types Exposed
- First and last names
- Mailing addresses
- Email addresses
- Phone numbers
- Delivery Point (PDL)
- Metering and Estimation Point (PCE)
- Customer IDs
- Contract numbers
- Information relating to energy contracts
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- ENGIE said it cut off the attackers' access to the compromised platform and that its internal IT systems were not compromised. The incident was limited to customers in France. ENGIE notified relevant authorities and contacted affected customers.
- Ransom Or Extortion
- No ransomware operation or extortion gang had claimed this breach before publication.
- Claim Status
- confirmed