French energy giant ENGIE has confirmed that attackers stole customer data after breaching a marketing platform used by its business partners, according to a company spokesperson. The breach is limited to customers in France and did not involve the company's internal systems, ENGIE said.
ENGIE, one of the world's largest power and natural gas providers, said it identified unusual data access activity within a tool used by partners for customer prospecting and marketing of energy offers. The company cut off the attackers' access to the compromised platform and notified relevant authorities and affected customers.
The information accessed includes customers' first and last names, mailing addresses, email addresses, phone numbers, delivery point or metering and estimation point identifiers, customer IDs, and contract numbers. ENGIE emphasised that no banking data was affected.
An ENGIE spokesperson told BleepingComputer that the company's internal IT systems were not compromised. "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.
ENGIE has not attributed the attack to a specific threat group, and no ransomware or extortion gang had claimed responsibility at the time of reporting. The company did not disclose how many customers were affected.
The breach follows a similar incident one year ago, when the Scattered LAPSUS$ Hunters extortion group leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America.
Analysis
Why This Matters
- Customer data from a major energy provider has been exposed, increasing the risk of phishing and fraud for affected individuals.
- The breach highlights vulnerabilities in partner-accessed platforms, a common attack vector that can bypass a company's internal security.
- As one of the world's largest energy companies, ENGIE's security stance is under scrutiny, and this incident may affect customer trust and regulatory compliance in France.
Background
French energy giant ENGIE is a global provider of power, natural gas, and renewable energy, operating in 30 countries with over 90,000 employees. The company reported €71.9 billion in revenue last year. This incident stems from a breach of a marketing platform used by business partners, not ENGIE's own systems, which the company said were not affected. A similar breach involving Engie Records, a North American subsidiary, occurred a year ago.
Key Perspectives
ENGIE: Says the breach was limited to a partner-used marketing tool, not its own systems, and that no banking data was accessed. The company has notified authorities and affected customers.
What to Watch
- Whether any threat group claims responsibility for the breach or releases the stolen data.
- Regulatory actions by French data protection authorities, given the involvement of customer personal data.
- Response from affected customers and any subsequent class-action complaints or lawsuits.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedENGIE confirmed a customer data breach.BleepingComputer: “French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.”
- SupportedAttackers accessed customer contact details and energy contract information through a marketing platform used by business partners.BleepingComputer: “The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts.”
- SupportedThe breach did not involve ENGIE's internal systems.BleepingComputer: “An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems.”
- SupportedThe breach was limited to customers in France.BleepingComputer: “The ENGIE spokesperson didn't say how many customers were affected, but told BleepingComputer the incident is limited to customers in France.”
- SupportedAn ENGIE spokesperson said: “ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers.”BleepingComputer: “"ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.”
- SupportedThe accessed information included customers' names, addresses, email addresses, phone numbers, delivery-point or metering-and-estimation-point identifiers, customer IDs and contract numbers.BleepingComputer: “the threat actors gained access to their first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.”
- SupportedNo banking data was affected.BleepingComputer: “No banking data is affected,”
- SupportedENGIE cut off the attackers' access, notified relevant authorities and contacted affected customers.BleepingComputer: “Since the attack, ENGIE has notified relevant authorities and contacted affected customers to inform them of the breach.”
- SupportedENGIE did not attribute the attack to a specific threat group.BleepingComputer: “ENGIE didn't attribute the attack to a specific threat group,”
- SupportedNo ransomware operation or extortion gang had claimed the ENGIE breach before publication.BleepingComputer: “no ransomware operation or extortion gang has claimed the ENGIE breach before publication.”
- SupportedENGIE did not disclose how many customers were affected.BleepingComputer: “The ENGIE spokesperson didn't say how many customers were affected,”
- SupportedOne year earlier, the Scattered LAPSUS$ Hunters extortion group leaked records it claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, a retail energy supply subsidiary of ENGIE North America.BleepingComputer: “One year ago, the Scattered LAPSUS$ Hunters extortion group also leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records , the retail energy supply subsidiary of ENGIE North America.”
