ENGIE Customer Data Stolen Through a Partner’s Sales Tool
ENGIE says attackers stole French customers' contact details and contract and meter numbers from a partner marketing platform; no banking data, and its own systems weren't hit.
French energy giant ENGIE says attackers stole customer data after breaking into a marketing tool its business partners use to sell energy contracts. ENGIE told BleepingComputer that it spotted “unusual data access activity” in the partner platform, cut the attackers off, and that its own internal IT systems weren’t compromised. The breach is limited to customers in France, it says.
For defenders
What’s confirmed: ENGIE says the stolen data is limited to contact details and some energy contract information, and that no banking data was involved. It has notified the authorities and is contacting affected customers individually. It hasn’t said how many people are affected or how the attackers got into the partner tool.
What the letters say: Breach notification letters, as reported by BleepingComputer, list first and last names, postal and email addresses, phone numbers, customer ID, contract number, and the meter identifiers French energy customers use (PDL for electricity, PCE for gas).
What isn’t known: No group has claimed the attack and ENGIE hasn’t attributed it. A separate claim a year ago, that the Scattered LAPSUS$ Hunters group breached a Salesforce instance at ENGIE’s North American retail arm, was never confirmed and isn’t linked to this incident. The pattern is a familiar one, though: the data leaked through a third party’s platform, not the company’s own network.
What it means for you
If you’re an ENGIE customer in France, a scammer may now know your name, address, phone number and the exact contract and meter numbers on your bill. That makes a fake “ENGIE” call or email very convincing: it can quote real details and then ask you to “confirm” bank information or pay an overdue bill. Your bank details weren’t taken, according to ENGIE, so anyone asking for them is the scam.
Do this now
- Treat any unexpected call, text or email about your energy contract with suspicion, even if it quotes your customer or contract number.
- Never give bank details, card numbers or passwords to someone who contacted you. Hang up and call ENGIE on the number on your bill or its official website.
- Watch your bank statements for unfamiliar direct debits, and be wary of offers to “switch” your contract that you didn’t ask for.