ENGIE confirms partner sales tool exposed French customer data

ENGIE confirmed attackers accessed customer contact details and energy contract information through a sales tool used by business partners. The incident affects only customers in France. Business partners used the sales tool to market electricity and natural gas offers in France. The breach came through a third-party partner channel rather than through ENGIE’s own internal systems.

The stolen information includes names, e-mail addresses, phone numbers, postal addresses, customer IDs, contract numbers and PDL or PCE supply identifiers. ENGIE said the exposed information could support impersonation scams. The company urged customers to verify unexpected requests through trusted channels.

ENGIE said its internal IT systems were not compromised and that attackers exposed no banking data. “ENGIE’s internal IT systems were not compromised,” an ENGIE spokesperson said. ENGIE described the exposed information as “limited to customers’ contact details and certain information relating to their energy contracts.”

ENGIE has not attributed the breach to a specific threat group. No ransomware cartel or extortion gang has claimed responsibility. ENGIE has not disclosed how many customers the breach affected. The company has not said which partner or vendor operates the compromised tool.

It has not said when the intrusion began. ENGIE has not revealed when it discovered the intrusion. ENGIE said it cut off the attackers’ access, alerted the proper authorities and contacted every affected customer directly.

“As soon as this activity was detected, the relevant access was disabled,” ENGIE said. The company said the breach is now contained. ENGIE started a detailed technical investigation to learn the circumstances, identify potentially affected customers and secure the situation. ENGIE put enhanced monitoring measures in place after it detected unusual data access.

ENGIE is active in 30 countries in infrastructure, customer energy supply and renewable energy, and it employs more than 90,000 people. The company supplies gas, nuclear power, and renewables across 30 countries. ENGIE posted revenue of 71.9 billion euros in its last reported year. Infosecurity Magazine cited almost €72 billion ($80 billion) for 2025.

Scattered LAPSUS$ Hunters listed ENGIE on its leak site last October after breaching over 100 Salesforce instances and taking more than one billion records. In that past incident, an ENGIE North America retail energy unit was the victim, and the group claimed to have obtained 3GB of data.

Resilience claims data shared with Infosecurity Magazine indicates that no energy and utilities clients in the UK or Europe reported ransomware since July 2025. Resilience said ransomware makes up about 70 percent of incurred losses in U.S. energy and utilities claims on record. European energy and utilities claims with a recorded cost concerned only fraud or exposed customer data.

The company reminded affected customers about precautions against possible fraud or phishing attempts. ENGIE told customers not to share banking details, passwords or SMS verification codes with unexpected callers or messengers. Security experts tell customers to go to ENGIE’s official website or app directly instead of logging in through links received by e-mail.

Notification e-mails sent to affected customers described the incident as involving a tool used by partners to sell electricity and natural gas offers. “unauthorized access to your personal data was identified,” the customer notification said.