ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their personal data through a marketing platform used by the company's business partners, the company confirmed this week.
The breach notification letters, dated October 23, went to affected customers after ENGIE said it detected "unusual data access activity" on the partner tool. The company has not stated exactly when the intrusion took place or how long the attacker had access before it was caught.
According to the notifications, the data the intruder obtained includes customers' first and last names, mailing addresses, email addresses, and phone numbers. It also includes two types of energy infrastructure identifiers specific to the French grid: the Delivery Point identifier (PDL) and the Metering and Estimation Point identifier (PCE). Both codes are tied to a customer's physical connection to the gas and electricity supply network. Customer IDs and contract numbers were also taken.
ENGIE said no banking data was involved, and that the breach was confined to the partner-facing marketing platform rather than any of its internal systems. The scope of the incident is currently limited to its French customer base, though the company has not said how many customers received notifications.
"We have cut off the attacker's access to the platform, notified the relevant authorities, and are directly informing each affected customer," the company said in a statement.
Customers were advised to stay alert to unsolicited contact and potential phishing attempts in the wake of the exposure.
No ransomware group or extortion actor had publicly claimed responsibility for the breach at the time of publication.
A Company With a Recurring Target on Its Back
ENGIE operates across 30 countries, employs more than 90,000 people, and posted €71.9 billion in revenue last year. Its scale across utilities, renewables, and energy infrastructure makes it a high-value target for threat actors looking for customer data at volume.
This latest breach is not the first time attackers have made it inside ENGIE's wider corporate ecosystem. Approximately a year ago, the Scattered LAPSUS$ Hunters group claimed it had breached a Salesforce instance belonging to Engie Records, the retail energy subsidiary of ENGIE North America, and leaked records from the intrusion. Engie Records appeared on the group's leak site as the 27th of 39 organizations allegedly hit through the same Salesforce-related campaign, with around 3GB of data listed.
Before that, in August 2023, a separate incident affected roughly 110,000 French ENGIE customers. In that case, a hacker known online as "HommedeLombre" reportedly got into ENGIE's systems through an external contractor's network, a technique also used in the Pôle Emploi breach around the same period. That attacker exposed names, email addresses, and phone numbers, and later said the intrusion was meant to demonstrate that "nothing is ever secure," citing rising gas prices as a grievance. ENGIE filed a complaint with authorities following that incident and said it had brought the affected system under control.
If we look closer to understand the link here, the three incidents point to a recurring problem: ENGIE's data, whether held by internal systems, subsidiaries, or third-party partners, keeps ending up in attackers' hands.
Why Energy Sector Customer Data Is Valuable
The combination of contact information and energy-specific identifiers like PDL and PCE codes makes the stolen data more useful to attackers than a standard contact list. Those codes link a name and address to a specific gas or electricity metering point in the French national grid, which means the data could be used to convincingly impersonate ENGIE in phishing campaigns or to target customers with fraudulent offers around energy billing or contracts.
France's energy market also went through a turbulent period of price volatility in recent years, which means many customers have been actively comparing suppliers and receiving legitimate outreach about tariff changes. That context makes it easier for fraudsters to craft believable messages that reference contract numbers, delivery point details, and billing information, exactly the kind of data now in circulation.
ENGIE said it has notified the relevant authorities, as required under GDPR. French data protection rules mandate that breaches of personal data be reported to the CNIL, the national data protection authority, within 72 hours of detection, and that affected individuals be notified without undue delay when the breach poses a risk to their rights and freedoms.
As of now, ENGIE has not attributed the breach to any specific threat actor, and it is unclear whether the platform through which the data was accessed belonged to an external vendor or an internal partner system. The investigation appears to be ongoing.
.jpg "Microsoft 365 Email Accounts Targeted in Multi-Phase Token Replay Campaign")
.jpg)
