ENGIE discloses data breach affecting customers in France

French energy giant ENGIE confirmed that attackers stole customer data after breaching a tool used by its partners for customer prospecting and the marketing of energy offers. An ENGIE spokesperson told BleepingComputer that the company cut off the attackers' access to the compromised platform, that its internal IT systems were not compromised, and that the incident is limited to customers in France. ENGIE has notified the relevant authorities and individually informed each affected customer. The company did not say how many customers were affected, so this is prepared as a Cybersecurity item, not a Breaches add.

Notification letters sent to affected customers say the data accessed includes first and last names, mailing addresses, email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE) identifiers, customer IDs and contract numbers. ENGIE said no banking data is affected. Cyberattaque.org independently obtained a copy of ENGIE's notification email and reported the same data fields on October 24, 2026. ENGIE reminded customers to take precautions against fraud and phishing attempts, and it did not attribute the attack to a specific threat group.

Sources: BleepingComputer; Cyberattaque.org