ENGIE data breach — customer data stolen via compromised partner marketing platform (France)
Severity: medium · Patch status: no-fix-needed · Since 2026-10-27
French energy giant ENGIE confirmed that attackers stole customer data after breaching a marketing platform used by business partners for customer prospecting and marketing of energy offers. The incident is limited to customers in France; ENGIE's internal IT systems were not compromised, and the company cut off attacker access after detecting unusual data access activity. Stolen data includes names, mailing and email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE) identifiers, customer IDs, and contract numbers. No banking data was affected. ENGIE notified authorities and individually informed affected customers, warning them about potential fraud or phishing. No threat group has been attributed, and no ransomware or extortion gang has claimed the breach; a year earlier Scattered LAPSUS$ Hunters leaked records allegedly stolen from Engie Records (ENGIE North America).
What to do
- Warn customers of ENGIE France about phishing and fraud attempts using their stolen contact and contract details
- Review access controls and monitoring on third-party/partner marketing platforms handling customer data
- Audit partner integrations for excessive data access and enforce least-privilege access
- Monitor for follow-on social engineering targeting energy customers using PDL/PCE and contract numbers
Sources
All live incidents on Threat Watch
