French energy giant ENGIE, one of the world’s largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.
An ENGIE spokesperson told BleepingComputer that it cut off the attackers’ access to the compromised platform and that they didn’t breach the company’s internal systems.
“ENGIE’s internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers,” the spokesperson said.
The ENGIE spokesperson didn’t say how many customers were affected, but told BleepingComputer the incident is limited to customers in France.
Since the attack, ENGIE has notified relevant authorities and contacted affected customers to inform them of the breach.
“The investigations conducted to date indicate that the data concerned is limited to customers’ contact details and certain information relating to their energy contracts. No banking data is affected,” ENGIE told BleepingComputer.
“In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts.”
Although the company didn’t share what customer information was stolen in the attack, it said in breach notification letters sent to affected customers that the threat actors gained access to their first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.
ENGIE didn’t attribute the attack to a specific threat group, and no ransomware operation or extortion gang has claimed the ENGIE breach before publication.
One year ago, the Scattered LAPSUS$ Hunters extortion group also leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Retail giant Ahold Delhaize takes systems offline after cyberattack
Nikkei discloses third data breach in a month, 1.8M records exposed
Burger King Japan data breach exposes 11 million customer records
UK Legal Aid Agency: Hackers stole records dating back to 1978
UK Housing Ombudsman Service investigates ‘security incident’
Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches
Microsoft releases emergency .NET patches for critical Brotli flaw
PHP2Shell security flaws now sucessfully exploited in the wild
Get your free 30-day browser security assessment
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
CTA: Hijacked sessions reach every app your users touch. See how Exaforce agents contain identity attacks
Who really has control of your AI agent? Gen is taking on the agent trust problem.
What can your AI agents actually do? Learn to control every action in our Nov. 18 webinar.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
